CVE-2024-49902

jfs: check if leafidx greater than num leaves per dmap tree

State: Published
Severity: 7.8 High
Published: Oct 21, 2024
Updated: Oct 15, 2026
Reserved: Oct 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

jfs: check if leafidx greater than num leaves per dmap tree

syzbot report a out of bounds in dbSplit, it because dmt_leafidx greater than num leaves per dmap tree, add a checking for dmt_leafidx in dbFindLeaf.

Shaggy: Modified sanity check to apply to control pages as well as leaf pages.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d76b9a4c283c7535ae7c7c9b14984e75402951e1Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 35b91f15f44ce3c01eba058ccb864bb04743e792Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2451e5917c56be45d4add786e2a059dd9c2c37c4Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 25d2a3ff02f22e215ce53355619df10cc5faa7abAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 058aa89b3318be3d66a103ba7c68d717561e1dc6Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7fff9a9f866e99931cf6fa260288e55d01626582Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before cb0eb10558802764f07de1dc439c4609e27cb4f0Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 4a7bf6a01fb441009a6698179a739957efd88e38Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d64ff0d2306713ff084d4b09f84ed1a8c75ecc32Affected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 4.19.323 through 4.19.Not affected 5.4.285 through 5.4.Not affected 5.10.227 through 5.10.Not affected 5.15.168 through 5.15.Not affected 6.1.113 through 6.1.Not affected 6.6.55 through 6.6.Not affected 6.10.14 through 6.10.Not affected 6.11.3 through 6.11.Not affected 6.12 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d76b9a4c283c7535ae7c7c9b14984e75402951e1Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 35b91f15f44ce3c01eba058ccb864bb04743e792Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 2451e5917c56be45d4add786e2a059dd9c2c37c4Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 25d2a3ff02f22e215ce53355619df10cc5faa7abAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 058aa89b3318be3d66a103ba7c68d717561e1dc6Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7fff9a9f866e99931cf6fa260288e55d01626582Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before cb0eb10558802764f07de1dc439c4609e27cb4f0Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 4a7bf6a01fb441009a6698179a739957efd88e38Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d64ff0d2306713ff084d4b09f84ed1a8c75ecc32Affected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
4.19.323 through 4.19.*Not affected
5.4.285 through 5.4.*Not affected
5.10.227 through 5.10.*Not affected
5.15.168 through 5.15.*Not affected
6.1.113 through 6.1.*Not affected
6.6.55 through 6.6.*Not affected
6.10.14 through 6.10.*Not affected
6.11.3 through 6.11.*Not affected
6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.