CVE-2024-40971

f2fs: remove clear SB_INLINECRYPT flag in default_options

State: Published
Severity: 7.3 High
Published: Jul 12, 2024
Updated: Oct 15, 2026
Reserved: Jul 12, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: remove clear SB_INLINECRYPT flag in default_options

In f2fs_remount, SB_INLINECRYPT flag will be clear and re-set. If create new file or open file during this gap, these files will not use inlinecrypt. Worse case, it may lead to data corruption if wrappedkey_v0 is enable.

Thread A: Thread B:

-f2fs_remount -f2fs_file_open or f2fs_new_inode -default_options <- clear SB_INLINECRYPT flag

-fscrypt_select_encryption_impl

-parse_options <- set SB_INLINECRYPT again

Scores

CVSS	Score	Vector	Source
3.1	7.3 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	98e4da8ca301e062d79ae168c67e56f3c3de3ce4 to before 38a82c8d00638bb642bef787eb1d5e0e4d3b7d71Affected 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 to before 724429db09e21ee153fef35e34342279d33df6aeAffected 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 to before a9cea0489c562c97cd56bb345e78939f9909e7f4Affected 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 to before eddeb8d941d5be11a9da5637dbe81ac37e8449a2Affected 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 to before ae39c8ec4250d2a35ddaab1c40faacfec306ff66Affected 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 to before ac5eecf481c29942eb9a862e758c0c8b68090c33Affected
LinuxLinux	3.8Affected before 3.8Not affected 5.10.221 through 5.10.Not affected 5.15.162 through 5.15.Not affected 6.1.96 through 6.1.Not affected 6.6.36 through 6.6.Not affected 6.9.7 through 6.9.*Not affected 6.10 and laterNot affected

Product

Versions

LinuxLinux

98e4da8ca301e062d79ae168c67e56f3c3de3ce4 to before 38a82c8d00638bb642bef787eb1d5e0e4d3b7d71Affected
98e4da8ca301e062d79ae168c67e56f3c3de3ce4 to before 724429db09e21ee153fef35e34342279d33df6aeAffected
98e4da8ca301e062d79ae168c67e56f3c3de3ce4 to before a9cea0489c562c97cd56bb345e78939f9909e7f4Affected
98e4da8ca301e062d79ae168c67e56f3c3de3ce4 to before eddeb8d941d5be11a9da5637dbe81ac37e8449a2Affected
98e4da8ca301e062d79ae168c67e56f3c3de3ce4 to before ae39c8ec4250d2a35ddaab1c40faacfec306ff66Affected
98e4da8ca301e062d79ae168c67e56f3c3de3ce4 to before ac5eecf481c29942eb9a862e758c0c8b68090c33Affected

LinuxLinux

3.8Affected
before 3.8Not affected
5.10.221 through 5.10.*Not affected
5.15.162 through 5.15.*Not affected
6.1.96 through 6.1.*Not affected
6.6.36 through 6.6.*Not affected
6.9.7 through 6.9.*Not affected
6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.