CVE-2024-41017

jfs: don't walk off the end of ealist

State: Published
Severity: 7.8 High
Published: Jul 29, 2024
Updated: Aug 5, 2026
Reserved: Jul 12, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

jfs: don't walk off the end of ealist

Add a check before visiting the members of ea to make sure each ea stays within the ealist.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7f91bd0f2941fa36449ce1a15faaa64f840d9746Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before fc16776a82e8df97b6c4f9a10ba95aa44cef7ba5Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6386f1b6a10e5d1ddd03db4ff6dfc55d488852ceAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7e21574195a45fc193555fa40e99fed16565ff7eAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 4e034f7e563ab723b93a59980e4a1bb33198ece8Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 17440dbc66ab98b410514b04987f61deedb86751Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f4435f476b9bf059cd9e26a69f5b29c768d00375Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before dbde7bc91093fa9c2410e418b236b70fde044b73Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d0fa70aca54c8643248e89061da23752506ec0d4Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 4.19.319 through 4.19.Not affected 5.4.281 through 5.4.Not affected 5.10.223 through 5.10.Not affected 5.15.164 through 5.15.Not affected 6.1.102 through 6.1.Not affected 6.6.43 through 6.6.Not affected 6.9.12 through 6.9.Not affected 6.10.2 through 6.10.Not affected 6.11 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7f91bd0f2941fa36449ce1a15faaa64f840d9746Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before fc16776a82e8df97b6c4f9a10ba95aa44cef7ba5Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 6386f1b6a10e5d1ddd03db4ff6dfc55d488852ceAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7e21574195a45fc193555fa40e99fed16565ff7eAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 4e034f7e563ab723b93a59980e4a1bb33198ece8Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 17440dbc66ab98b410514b04987f61deedb86751Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before f4435f476b9bf059cd9e26a69f5b29c768d00375Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before dbde7bc91093fa9c2410e418b236b70fde044b73Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d0fa70aca54c8643248e89061da23752506ec0d4Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
4.19.319 through 4.19.*Not affected
5.4.281 through 5.4.*Not affected
5.10.223 through 5.10.*Not affected
5.15.164 through 5.15.*Not affected
6.1.102 through 6.1.*Not affected
6.6.43 through 6.6.*Not affected
6.9.12 through 6.9.*Not affected
6.10.2 through 6.10.*Not affected
6.11 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.