CVE-2024-49957

ocfs2: fix null-ptr-deref when journal load failed.

State: Published
Severity: Not scored
Published: Oct 21, 2024
Updated: May 11, 2026
Reserved: Oct 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix null-ptr-deref when journal load failed.

During the mounting process, if journal_reset() fails because of too short journal, then lead to jbd2_journal_load() fails with NULL j_sb_buffer. Subsequently, ocfs2_journal_shutdown() calls jbd2_journal_flush()->jbd2_cleanup_journal_tail()-> __jbd2_update_log_tail()->jbd2_journal_update_sb_log_tail() ->lock_buffer(journal->j_sb_buffer), resulting in a null-pointer dereference error.

To resolve this issue, we should check the JBD2_LOADED flag to ensure the journal was properly loaded. Additionally, use journal instead of osb->journal directly to simplify the code.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 to before fd89d92c1140cee8f59de336cb37fa65e359c123Affected f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 to before 703b2c7e0798d263154dc8593dc2345f75dc077fAffected f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 to before bf605ae98dab5c15c5b631d4d7f88898cb41b649Affected f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 to before ff55291fb36779819211b596da703389135f5b05Affected f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 to before 82dfdd1e31e774578f76ce6dc90c834f96403a0fAffected f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 to before 86a89e75e9e4dfa768b97db466ad6bedf2e7ea5bAffected f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 to before f60e94a83db799bde625ac8671a5b4a6354e7120Affected f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 to before 387bf565cc03e2e8c720b8b4798efea4aacb6962Affected f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 to before 5784d9fcfd43bd853654bb80c87ef293b9e8e80aAffected
LinuxLinux	2.6.32Affected before 2.6.32Not affected 4.19.323 through 4.19.Not affected 5.4.285 through 5.4.Not affected 5.10.227 through 5.10.Not affected 5.15.168 through 5.15.Not affected 6.1.113 through 6.1.Not affected 6.6.55 through 6.6.Not affected 6.10.14 through 6.10.Not affected 6.11.3 through 6.11.Not affected 6.12 and laterNot affected

Product

Versions

LinuxLinux

f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 to before fd89d92c1140cee8f59de336cb37fa65e359c123Affected
f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 to before 703b2c7e0798d263154dc8593dc2345f75dc077fAffected
f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 to before bf605ae98dab5c15c5b631d4d7f88898cb41b649Affected
f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 to before ff55291fb36779819211b596da703389135f5b05Affected
f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 to before 82dfdd1e31e774578f76ce6dc90c834f96403a0fAffected
f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 to before 86a89e75e9e4dfa768b97db466ad6bedf2e7ea5bAffected
f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 to before f60e94a83db799bde625ac8671a5b4a6354e7120Affected
f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 to before 387bf565cc03e2e8c720b8b4798efea4aacb6962Affected
f6f50e28f0cb8d7bcdfaacc83129f005dede11b1 to before 5784d9fcfd43bd853654bb80c87ef293b9e8e80aAffected

LinuxLinux

2.6.32Affected
before 2.6.32Not affected
4.19.323 through 4.19.*Not affected
5.4.285 through 5.4.*Not affected
5.10.227 through 5.10.*Not affected
5.15.168 through 5.15.*Not affected
6.1.113 through 6.1.*Not affected
6.6.55 through 6.6.*Not affected
6.10.14 through 6.10.*Not affected
6.11.3 through 6.11.*Not affected
6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.