CVE-2024-49960

ext4: fix timer use-after-free on failed mount

State: Published
Severity: 7.8 High
Published: Oct 21, 2024
Updated: Aug 5, 2026
Reserved: Oct 21, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix timer use-after-free on failed mount

Syzbot has found an ODEBUG bug in ext4_fill_super

The del_timer_sync function cancels the s_err_report timer, which reminds about filesystem errors daily. We should guarantee the timer is no longer active before kfree(sbi).

When filesystem mounting fails, the flow goes to failed_mount3, where an error occurs when ext4_stop_mmpd is called, causing a read I/O failure. This triggers the ext4_handle_error function that ultimately re-arms the timer, leaving the s_err_report timer active before kfree(sbi) is called.

Fix the issue by canceling the s_err_report timer after calling ext4_stop_mmpd.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	5e4f5138bd8522ebe231a137682d3857209a2c07 to before 7aac0c17a8cdf4a3236991c1e60435c6a984076cAffected 618f003199c6188e01472b03cdbba227f1dc5f24 to before 22e9b83f0f33bc5a7a3181769d1dccbf021f5b04Affected 618f003199c6188e01472b03cdbba227f1dc5f24 to before cf3196e5e2f36cd80dab91ffae402e13935724bcAffected 618f003199c6188e01472b03cdbba227f1dc5f24 to before 9203817ba46ebba7c865c8de2aba399537b6e891Affected 618f003199c6188e01472b03cdbba227f1dc5f24 to before fa78fb51d396f4f2f80f8e96a3b1516f394258beAffected 618f003199c6188e01472b03cdbba227f1dc5f24 to before b85569585d0154d4db1e4f9e3e6a4731d407feb0Affected 618f003199c6188e01472b03cdbba227f1dc5f24 to before 0ce160c5bdb67081a62293028dc85758a8efb22aAffected cecfdb9cf9a700d1037066173abac0617f6788dfAffected eb7b40d9d3785f7a131fb0b1f89bb6efa46c1833Affected 5.10.51 to before 5.10.237Affected 5.12.18 to before 5.13Affected 5.13.3 to before 5.14Affected
LinuxLinux	5.14Affected before 5.14Not affected 5.10.237 through 5.10.Not affected 5.15.181 through 5.15.Not affected 6.1.118 through 6.1.Not affected 6.6.55 through 6.6.Not affected 6.10.14 through 6.10.Not affected 6.11.3 through 6.11.Not affected 6.12 and laterNot affected

Product

Versions

LinuxLinux

5e4f5138bd8522ebe231a137682d3857209a2c07 to before 7aac0c17a8cdf4a3236991c1e60435c6a984076cAffected
618f003199c6188e01472b03cdbba227f1dc5f24 to before 22e9b83f0f33bc5a7a3181769d1dccbf021f5b04Affected
618f003199c6188e01472b03cdbba227f1dc5f24 to before cf3196e5e2f36cd80dab91ffae402e13935724bcAffected
618f003199c6188e01472b03cdbba227f1dc5f24 to before 9203817ba46ebba7c865c8de2aba399537b6e891Affected
618f003199c6188e01472b03cdbba227f1dc5f24 to before fa78fb51d396f4f2f80f8e96a3b1516f394258beAffected
618f003199c6188e01472b03cdbba227f1dc5f24 to before b85569585d0154d4db1e4f9e3e6a4731d407feb0Affected
618f003199c6188e01472b03cdbba227f1dc5f24 to before 0ce160c5bdb67081a62293028dc85758a8efb22aAffected
cecfdb9cf9a700d1037066173abac0617f6788dfAffected
eb7b40d9d3785f7a131fb0b1f89bb6efa46c1833Affected
5.10.51 to before 5.10.237Affected
5.12.18 to before 5.13Affected
5.13.3 to before 5.14Affected

LinuxLinux

5.14Affected
before 5.14Not affected
5.10.237 through 5.10.*Not affected
5.15.181 through 5.15.*Not affected
6.1.118 through 6.1.*Not affected
6.6.55 through 6.6.*Not affected
6.10.14 through 6.10.*Not affected
6.11.3 through 6.11.*Not affected
6.12 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.