CVE-2024-39482

bcache: fix variable length array abuse in btree_iter

State: Published
Severity: 7.8 High
Published: Jul 5, 2024
Updated: Oct 15, 2026
Reserved: Jun 25, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

bcache: fix variable length array abuse in btree_iter

btree_iter is used in two ways: either allocated on the stack with a fixed size MAX_BSETS, or from a mempool with a dynamic size based on the specific cache set. Previously, the struct had a fixed-length array of size MAX_BSETS which was indexed out-of-bounds for the dynamically-sized iterators, which causes UBSAN to complain.

This patch uses the same approach as in bcachefs's sort_iter and splits the iterator into a btree_iter with a flexible array member and a btree_iter_stack which embeds a btree_iter as well as a fixed-length data array.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	cafe563591446cf80bfbc2fe3bc72a2e36cf1060 to before 2c3d7b03b658dc8bfa6112b194b67b92a87e081bAffected cafe563591446cf80bfbc2fe3bc72a2e36cf1060 to before 5a1922adc5798b7ec894cd3f197afb6f9591b023Affected cafe563591446cf80bfbc2fe3bc72a2e36cf1060 to before 934e1e4331859183a861f396d7dfaf33cb5afb02Affected cafe563591446cf80bfbc2fe3bc72a2e36cf1060 to before 6479b9f41583b013041943c4602e1ad61cec8148Affected cafe563591446cf80bfbc2fe3bc72a2e36cf1060 to before 0c31344e22dd8d6b1394c6e4c41d639015bdc671Affected cafe563591446cf80bfbc2fe3bc72a2e36cf1060 to before 3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31Affected
LinuxLinux	3.10Affected before 3.10Not affected 5.10.221 through 5.10.Not affected 5.15.162 through 5.15.Not affected 6.1.94 through 6.1.Not affected 6.6.34 through 6.6.Not affected 6.9.5 through 6.9.*Not affected 6.10 and laterNot affected

Product

Versions

LinuxLinux

cafe563591446cf80bfbc2fe3bc72a2e36cf1060 to before 2c3d7b03b658dc8bfa6112b194b67b92a87e081bAffected
cafe563591446cf80bfbc2fe3bc72a2e36cf1060 to before 5a1922adc5798b7ec894cd3f197afb6f9591b023Affected
cafe563591446cf80bfbc2fe3bc72a2e36cf1060 to before 934e1e4331859183a861f396d7dfaf33cb5afb02Affected
cafe563591446cf80bfbc2fe3bc72a2e36cf1060 to before 6479b9f41583b013041943c4602e1ad61cec8148Affected
cafe563591446cf80bfbc2fe3bc72a2e36cf1060 to before 0c31344e22dd8d6b1394c6e4c41d639015bdc671Affected
cafe563591446cf80bfbc2fe3bc72a2e36cf1060 to before 3a861560ccb35f2a4f0a4b8207fa7c2a35fc7f31Affected

LinuxLinux

3.10Affected
before 3.10Not affected
5.10.221 through 5.10.*Not affected
5.15.162 through 5.15.*Not affected
6.1.94 through 6.1.*Not affected
6.6.34 through 6.6.*Not affected
6.9.5 through 6.9.*Not affected
6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.