Riskcovery

CVE-2024-53234

erofs: handle NONHEAD !delta[1] lclusters gracefully

State
Published
Severity
Not scored
Published
Dec 27, 2024
Updated
May 23, 2026
Reserved
Nov 19, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

erofs: handle NONHEAD !delta[1] lclusters gracefully

syzbot reported a WARNING in iomap_iter_done: iomap_fiemap+0x73b/0x9b0 fs/iomap/fiemap.c:80 ioctl_fiemap fs/ioctl.c:220 [inline]

Generally, NONHEAD lclusters won't have delta[1]==0, except for crafted images and filesystems created by pre-1.0 mkfs versions.

Previously, it would immediately bail out if delta[1]==0, which led to inadequate decompressed lengths (thus FIEMAP is impacted). Treat it as delta[1]=1 to work around these legacy mkfs versions.

`lclusterbits > 14` is illegal for compact indexes, error out too.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • d95ae5e25326092d61613acf98280270dde22778 to before 75a0a6dde803e7a3af700da8da9a361b49f69ebaAffected
  • d95ae5e25326092d61613acf98280270dde22778 to before f466641debcbea8bdf78d1b63a6270aadf9301bfAffected
  • d95ae5e25326092d61613acf98280270dde22778 to before 480c6c7b55aeacac800bc2a0d321ff53273045e5Affected
  • d95ae5e25326092d61613acf98280270dde22778 to before daaf68fef4b2ff97928227630021d37b27a96655Affected
  • d95ae5e25326092d61613acf98280270dde22778 to before 0bc8061ffc733a0a246b8689b2d32a3e9204f43cAffected
  • 96a85becb811ca2ce21a21721f1544d342ae431eAffected
  • 8c723eef989bc419585237daa467b787ddca5415Affected
  • 5.4.251 to before 5.5Affected
  • 5.10.188 to before 5.11Affected
LinuxLinux
  • 5.15Affected
  • before 5.15Not affected
  • 6.1.127 through 6.1.*Not affected
  • 6.6.64 through 6.6.*Not affected
  • 6.11.11 through 6.11.*Not affected
  • 6.12.2 through 6.12.*Not affected
  • 6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.