CVE-2024-26773 (GCVE-0-2024-26773)

Vulnerability from cvelistv5 – Published: 2024-04-03 17:00 – Updated: 2026-08-05 11:27
VLAI
Title
ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
Summary
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() Determine if the group block bitmap is corrupted before using ac_b_ex in ext4_mb_try_best_found() to avoid allocating blocks from a group with a corrupted block bitmap in the following concurrency and making the situation worse. ext4_mb_regular_allocator ext4_lock_group(sb, group) ext4_mb_good_group // check if the group bbitmap is corrupted ext4_mb_complex_scan_group // Scan group gets ac_b_ex but doesn't use it ext4_unlock_group(sb, group) ext4_mark_group_bitmap_corrupted(group) // The block bitmap was corrupted during // the group unlock gap. ext4_mb_try_best_found ext4_lock_group(ac->ac_sb, group) ext4_mb_use_best_found mb_mark_used // Allocating blocks in block bitmap corrupted group
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 163a203ddb36c36d4a1c942aececda0cc8d06aa7 , < 21f8cfe79f776287459343e9cfa6055af61328ea (git)
Affected: 163a203ddb36c36d4a1c942aececda0cc8d06aa7 , < 260fc96283c0f594de18a1b045faf6d8fb42874d (git)
Affected: 163a203ddb36c36d4a1c942aececda0cc8d06aa7 , < 927794a02169778c9c2e7b25c768ab3ea8c1dc03 (git)
Affected: 163a203ddb36c36d4a1c942aececda0cc8d06aa7 , < 4c21fa60a6f4606f6214a38f50612b17b2f738f5 (git)
Affected: 163a203ddb36c36d4a1c942aececda0cc8d06aa7 , < f97e75fa4e12b0aa0224e83fcbda8853ac2adf36 (git)
Affected: 163a203ddb36c36d4a1c942aececda0cc8d06aa7 , < 0184747b552d6b5a14db3b7fcc3b792ce64dedd1 (git)
Affected: 163a203ddb36c36d4a1c942aececda0cc8d06aa7 , < a2576ae9a35c078e488f2c573e9e6821d651fbbe (git)
Affected: 163a203ddb36c36d4a1c942aececda0cc8d06aa7 , < 4530b3660d396a646aad91a787b6ab37cf604b53 (git)
Create a notification for this product.
Linux Linux Affected: 3.12
Unaffected: 0 , < 3.12 (semver)
Unaffected: 4.19.308 , ≤ 4.19.* (semver)
Unaffected: 5.4.270 , ≤ 5.4.* (semver)
Unaffected: 5.10.211 , ≤ 5.10.* (semver)
Unaffected: 5.15.150 , ≤ 5.15.* (semver)
Unaffected: 6.1.80 , ≤ 6.1.* (semver)
Unaffected: 6.6.19 , ≤ 6.6.* (semver)
Unaffected: 6.7.7 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-26773",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-03T18:50:26.209110Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:49:10.181Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:14:13.512Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/21f8cfe79f776287459343e9cfa6055af61328ea"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/927794a02169778c9c2e7b25c768ab3ea8c1dc03"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4c21fa60a6f4606f6214a38f50612b17b2f738f5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f97e75fa4e12b0aa0224e83fcbda8853ac2adf36"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0184747b552d6b5a14db3b7fcc3b792ce64dedd1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/a2576ae9a35c078e488f2c573e9e6821d651fbbe"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4530b3660d396a646aad91a787b6ab37cf604b53"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/mballoc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "21f8cfe79f776287459343e9cfa6055af61328ea",
              "status": "affected",
              "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7",
              "versionType": "git"
            },
            {
              "lessThan": "260fc96283c0f594de18a1b045faf6d8fb42874d",
              "status": "affected",
              "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7",
              "versionType": "git"
            },
            {
              "lessThan": "927794a02169778c9c2e7b25c768ab3ea8c1dc03",
              "status": "affected",
              "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7",
              "versionType": "git"
            },
            {
              "lessThan": "4c21fa60a6f4606f6214a38f50612b17b2f738f5",
              "status": "affected",
              "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7",
              "versionType": "git"
            },
            {
              "lessThan": "f97e75fa4e12b0aa0224e83fcbda8853ac2adf36",
              "status": "affected",
              "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7",
              "versionType": "git"
            },
            {
              "lessThan": "0184747b552d6b5a14db3b7fcc3b792ce64dedd1",
              "status": "affected",
              "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7",
              "versionType": "git"
            },
            {
              "lessThan": "a2576ae9a35c078e488f2c573e9e6821d651fbbe",
              "status": "affected",
              "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7",
              "versionType": "git"
            },
            {
              "lessThan": "4530b3660d396a646aad91a787b6ab37cf604b53",
              "status": "affected",
              "version": "163a203ddb36c36d4a1c942aececda0cc8d06aa7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/mballoc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.308",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.150",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.308",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.270",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.211",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.150",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.80",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.19",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.7",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()\n\nDetermine if the group block bitmap is corrupted before using ac_b_ex in\next4_mb_try_best_found() to avoid allocating blocks from a group with a\ncorrupted block bitmap in the following concurrency and making the\nsituation worse.\n\next4_mb_regular_allocator\n  ext4_lock_group(sb, group)\n  ext4_mb_good_group\n   // check if the group bbitmap is corrupted\n  ext4_mb_complex_scan_group\n   // Scan group gets ac_b_ex but doesn\u0027t use it\n  ext4_unlock_group(sb, group)\n                           ext4_mark_group_bitmap_corrupted(group)\n                           // The block bitmap was corrupted during\n                           // the group unlock gap.\n  ext4_mb_try_best_found\n    ext4_lock_group(ac-\u003eac_sb, group)\n    ext4_mb_use_best_found\n      mb_mark_used\n      // Allocating blocks in block bitmap corrupted group"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable allocator is reached only through local filesystem operations (`write()`, `fallocate()`, truncate/extend) on a mounted ext4 filesystem via `ext4_mb_new_blocks()` \u2192 `ext4_mb_regular_allocator()`. No network protocol handler parses data that reaches this code directly.\nAC:L - The attacker drives both sides of the window \u2014 many concurrent writer threads on the same block group both create the allocation pressure that forces the `ac_b_ex.fe_len \u003e 0 \u0026\u0026 !AC_STATUS_FOUND` fallback into `ext4_mb_try_best_found()` and supply the concurrent free/scan that flags the group corrupt \u2014 and the same-thread path (corruption detected inside `ext4_mb_complex_scan_group()`, `break`, then the fallback allocation) needs no race at all; the sequence can be retried indefinitely at no cost.\nPR:L - Only an unprivileged local account with write access to any ext4 mount (`/tmp`, `/home`, an app data partition on Android/embedded) is needed; no capability, mount privilege, or fs-specific permission is consulted on the allocation path.\nUI:N - Once a group is flagged corrupt \u2014 by media aging on eMMC/flash in embedded and automotive deployments, by a prior detected double-free, or by the free-count mismatch the attacker\u0027s own concurrent allocation traffic provokes \u2014 exploitation is entirely the attacker\u0027s own syscalls, with no victim mount or file access required.\nS:U - The damaged resources are the ext4 block bitmap, buddy state, and file data, all managed by the same kernel security authority as the vulnerable code; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Allocating from a group whose bitmap is known-inconsistent hands the attacker\u0027s file blocks that are still referenced by other inodes \u2014 the double-free detector\u0027s case is exactly \"this block is still owned by another file\" \u2014 so simply reading the attacker\u0027s own new file discloses other users\u0027 and system files\u0027 on-disk contents.\nI:H - The same double allocation lets attacker-controlled writes land on blocks belonging to other users\u0027 files and, where the bitmap accounting is wrong for metadata blocks, on ext4 metadata (inode table, bitmaps), corrupting foreign data and inode fields in a way that is leverageable for privilege escalation.\nA:H - Operating on the inconsistent buddy triggers `BUG_ON(ord \u003c= 0)` / `BUG_ON((start \u003e\u003e ord) \u003e= max)` in `mb_mark_used()`, `bb_free`/`bb_fragments` underflow feeding the divide-by-zero in `mb_update_avg_fragment_size()`, and `ext4_grp_locked_error()`, which forces the filesystem read-only by default and panics the kernel with `errors=panic`."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:27:10.867Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/21f8cfe79f776287459343e9cfa6055af61328ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d"
        },
        {
          "url": "https://git.kernel.org/stable/c/927794a02169778c9c2e7b25c768ab3ea8c1dc03"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c21fa60a6f4606f6214a38f50612b17b2f738f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/f97e75fa4e12b0aa0224e83fcbda8853ac2adf36"
        },
        {
          "url": "https://git.kernel.org/stable/c/0184747b552d6b5a14db3b7fcc3b792ce64dedd1"
        },
        {
          "url": "https://git.kernel.org/stable/c/a2576ae9a35c078e488f2c573e9e6821d651fbbe"
        },
        {
          "url": "https://git.kernel.org/stable/c/4530b3660d396a646aad91a787b6ab37cf604b53"
        }
      ],
      "title": "ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-26773",
    "datePublished": "2024-04-03T17:00:59.757Z",
    "dateReserved": "2024-02-19T14:20:24.176Z",
    "dateUpdated": "2026-08-05T11:27:10.867Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-26773",
      "date": "2026-08-05",
      "epss": "0.00312",
      "percentile": "0.23516"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\next4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()\\n\\nDetermine if the group block bitmap is corrupted before using ac_b_ex in\\next4_mb_try_best_found() to avoid allocating blocks from a group with a\\ncorrupted block bitmap in the following concurrency and making the\\nsituation worse.\\n\\next4_mb_regular_allocator\\n  ext4_lock_group(sb, group)\\n  ext4_mb_good_group\\n   // check if the group bbitmap is corrupted\\n  ext4_mb_complex_scan_group\\n   // Scan group gets ac_b_ex but doesn\u0027t use it\\n  ext4_unlock_group(sb, group)\\n                           ext4_mark_group_bitmap_corrupted(group)\\n                           // The block bitmap was corrupted during\\n                           // the group unlock gap.\\n  ext4_mb_try_best_found\\n    ext4_lock_group(ac-\u003eac_sb, group)\\n    ext4_mb_use_best_found\\n      mb_mark_used\\n      // Allocating blocks in block bitmap corrupted group\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: ext4: evite asignar bloques de un grupo da\\u00f1ado en ext4_mb_try_best_found() Determine si el mapa de bits del bloque del grupo est\\u00e1 da\\u00f1ado antes de usar ac_b_ex en ext4_mb_try_best_found() para evitar asignar bloques de un grupo con un bloque da\\u00f1ado mapa de bits en la siguiente concurrencia y empeorando la situaci\\u00f3n. ext4_mb_regular_allocator ext4_lock_group(sb, group) ext4_mb_good_group // verifica si el bbitmap del grupo est\\u00e1 da\\u00f1ado ext4_mb_complex_scan_group // El grupo de escaneo obtiene ac_b_ex pero no lo usa ext4_unlock_group(sb, group) ext4_mark_group_bitmap_corrupted(group) // El mapa de bits del bloque se corrompi\\u00f3 durante // el grupo desbloquea la brecha. ext4_mb_try_best_found ext4_lock_group(ac-\u0026gt;ac_sb, group) ext4_mb_use_best_found mb_mark_used // Asignaci\\u00f3n de bloques en un grupo da\\u00f1ado de mapa de bits de bloques\"}]",
      "id": "CVE-2024-26773",
      "lastModified": "2024-11-21T09:03:02.380",
      "published": "2024-04-03T17:15:53.080",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/0184747b552d6b5a14db3b7fcc3b792ce64dedd1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/21f8cfe79f776287459343e9cfa6055af61328ea\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/4530b3660d396a646aad91a787b6ab37cf604b53\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/4c21fa60a6f4606f6214a38f50612b17b2f738f5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/927794a02169778c9c2e7b25c768ab3ea8c1dc03\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a2576ae9a35c078e488f2c573e9e6821d651fbbe\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f97e75fa4e12b0aa0224e83fcbda8853ac2adf36\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/0184747b552d6b5a14db3b7fcc3b792ce64dedd1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/21f8cfe79f776287459343e9cfa6055af61328ea\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/4530b3660d396a646aad91a787b6ab37cf604b53\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/4c21fa60a6f4606f6214a38f50612b17b2f738f5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/927794a02169778c9c2e7b25c768ab3ea8c1dc03\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/a2576ae9a35c078e488f2c573e9e6821d651fbbe\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/f97e75fa4e12b0aa0224e83fcbda8853ac2adf36\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-26773\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-04-03T17:15:53.080\",\"lastModified\":\"2026-08-04T11:17:03.457\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\next4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()\\n\\nDetermine if the group block bitmap is corrupted before using ac_b_ex in\\next4_mb_try_best_found() to avoid allocating blocks from a group with a\\ncorrupted block bitmap in the following concurrency and making the\\nsituation worse.\\n\\next4_mb_regular_allocator\\n  ext4_lock_group(sb, group)\\n  ext4_mb_good_group\\n   // check if the group bbitmap is corrupted\\n  ext4_mb_complex_scan_group\\n   // Scan group gets ac_b_ex but doesn\u0027t use it\\n  ext4_unlock_group(sb, group)\\n                           ext4_mark_group_bitmap_corrupted(group)\\n                           // The block bitmap was corrupted during\\n                           // the group unlock gap.\\n  ext4_mb_try_best_found\\n    ext4_lock_group(ac-\u003eac_sb, group)\\n    ext4_mb_use_best_found\\n      mb_mark_used\\n      // Allocating blocks in block bitmap corrupted group\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: ext4: evite asignar bloques de un grupo da\u00f1ado en ext4_mb_try_best_found() Determine si el mapa de bits del bloque del grupo est\u00e1 da\u00f1ado antes de usar ac_b_ex en ext4_mb_try_best_found() para evitar asignar bloques de un grupo con un bloque da\u00f1ado mapa de bits en la siguiente concurrencia y empeorando la situaci\u00f3n. ext4_mb_regular_allocator ext4_lock_group(sb, group) ext4_mb_good_group // verifica si el bbitmap del grupo est\u00e1 da\u00f1ado ext4_mb_complex_scan_group // El grupo de escaneo obtiene ac_b_ex pero no lo usa ext4_unlock_group(sb, group) ext4_mark_group_bitmap_corrupted(group) // El mapa de bits del bloque se corrompi\u00f3 durante // el grupo desbloquea la brecha. ext4_mb_try_best_found ext4_lock_group(ac-\u0026gt;ac_sb, group) ext4_mb_use_best_found mb_mark_used // Asignaci\u00f3n de bloques en un grupo da\u00f1ado de mapa de bits de bloques\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ext4/mballoc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"163a203ddb36c36d4a1c942aececda0cc8d06aa7\",\"lessThan\":\"21f8cfe79f776287459343e9cfa6055af61328ea\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"163a203ddb36c36d4a1c942aececda0cc8d06aa7\",\"lessThan\":\"260fc96283c0f594de18a1b045faf6d8fb42874d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"163a203ddb36c36d4a1c942aececda0cc8d06aa7\",\"lessThan\":\"927794a02169778c9c2e7b25c768ab3ea8c1dc03\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"163a203ddb36c36d4a1c942aececda0cc8d06aa7\",\"lessThan\":\"4c21fa60a6f4606f6214a38f50612b17b2f738f5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"163a203ddb36c36d4a1c942aececda0cc8d06aa7\",\"lessThan\":\"f97e75fa4e12b0aa0224e83fcbda8853ac2adf36\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"163a203ddb36c36d4a1c942aececda0cc8d06aa7\",\"lessThan\":\"0184747b552d6b5a14db3b7fcc3b792ce64dedd1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"163a203ddb36c36d4a1c942aececda0cc8d06aa7\",\"lessThan\":\"a2576ae9a35c078e488f2c573e9e6821d651fbbe\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"163a203ddb36c36d4a1c942aececda0cc8d06aa7\",\"lessThan\":\"4530b3660d396a646aad91a787b6ab37cf604b53\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ext4/mballoc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.308\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.270\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.211\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.150\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.80\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.19\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.7\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-04-03T18:50:26.209110Z\",\"id\":\"CVE-2024-26773\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.19.308\",\"matchCriteriaId\":\"B6FB6042-3E0F-4A36-8DED-B3C350612BDC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.270\",\"matchCriteriaId\":\"5D8044B1-C7E8-44A4-9F03-A4D7BCDB1721\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.211\",\"matchCriteriaId\":\"7DDA4DCF-671D-415D-94DF-6E3C77DF0704\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.150\",\"matchCriteriaId\":\"CB6C60DE-9E0C-46C5-904D-D4F4031F8E95\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.80\",\"matchCriteriaId\":\"BA7850CE-97C9-4408-A348-6173296BCA2B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.19\",\"matchCriteriaId\":\"8D82004C-B2AE-4048-9344-32EFF65953B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.7\",\"matchCriteriaId\":\"575EE16B-67F2-4B5B-B5F8-1877715C898B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9F4EA73-0894-400F-A490-3A397AB7A517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"056BD938-0A27-4569-B391-30578B309EE3\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0184747b552d6b5a14db3b7fcc3b792ce64dedd1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/21f8cfe79f776287459343e9cfa6055af61328ea\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4530b3660d396a646aad91a787b6ab37cf604b53\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4c21fa60a6f4606f6214a38f50612b17b2f738f5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/927794a02169778c9c2e7b25c768ab3ea8c1dc03\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a2576ae9a35c078e488f2c573e9e6821d651fbbe\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f97e75fa4e12b0aa0224e83fcbda8853ac2adf36\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0184747b552d6b5a14db3b7fcc3b792ce64dedd1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/21f8cfe79f776287459343e9cfa6055af61328ea\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4530b3660d396a646aad91a787b6ab37cf604b53\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4c21fa60a6f4606f6214a38f50612b17b2f738f5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/927794a02169778c9c2e7b25c768ab3ea8c1dc03\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a2576ae9a35c078e488f2c573e9e6821d651fbbe\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f97e75fa4e12b0aa0224e83fcbda8853ac2adf36\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:10:35+00:00",
      "cve": "CVE-2024-26773",
      "id": "CVE-2024-26773",
      "initial_release_date": "2024-04-03T00:00:00+00:00",
      "product_status:fixed": "929",
      "product_status:known_affected": "64",
      "product_status:known_not_affected": "9",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-26773.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:56:16Z",
      "cve": "CVE-2024-26773",
      "id": "CVE-2024-26773",
      "initial_release_date": "2024-04-11T02:30:58Z",
      "product_status:known_affected": "510",
      "product_status:recommended": "867",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-26773",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-26773.json",
      "version": "90"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/21f8cfe79f776287459343e9cfa6055af61328ea\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/927794a02169778c9c2e7b25c768ab3ea8c1dc03\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4c21fa60a6f4606f6214a38f50612b17b2f738f5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f97e75fa4e12b0aa0224e83fcbda8853ac2adf36\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/0184747b552d6b5a14db3b7fcc3b792ce64dedd1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/a2576ae9a35c078e488f2c573e9e6821d651fbbe\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/4530b3660d396a646aad91a787b6ab37cf604b53\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T00:14:13.512Z\"}}, {\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-26773\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-04-03T18:50:26.209110Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-23T19:01:21.835Z\"}, \"title\": \"CISA ADP Vulnrichment\"}], \"cna\": {\"title\": \"ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable allocator is reached only through local filesystem operations (`write()`, `fallocate()`, truncate/extend) on a mounted ext4 filesystem via `ext4_mb_new_blocks()` \\u2192 `ext4_mb_regular_allocator()`. No network protocol handler parses data that reaches this code directly.\\nAC:L - The attacker drives both sides of the window \\u2014 many concurrent writer threads on the same block group both create the allocation pressure that forces the `ac_b_ex.fe_len \u003e 0 \u0026\u0026 !AC_STATUS_FOUND` fallback into `ext4_mb_try_best_found()` and supply the concurrent free/scan that flags the group corrupt \\u2014 and the same-thread path (corruption detected inside `ext4_mb_complex_scan_group()`, `break`, then the fallback allocation) needs no race at all; the sequence can be retried indefinitely at no cost.\\nPR:L - Only an unprivileged local account with write access to any ext4 mount (`/tmp`, `/home`, an app data partition on Android/embedded) is needed; no capability, mount privilege, or fs-specific permission is consulted on the allocation path.\\nUI:N - Once a group is flagged corrupt \\u2014 by media aging on eMMC/flash in embedded and automotive deployments, by a prior detected double-free, or by the free-count mismatch the attacker\u0027s own concurrent allocation traffic provokes \\u2014 exploitation is entirely the attacker\u0027s own syscalls, with no victim mount or file access required.\\nS:U - The damaged resources are the ext4 block bitmap, buddy state, and file data, all managed by the same kernel security authority as the vulnerable code; no hypervisor, IOMMU, or sandbox boundary is crossed.\\nC:H - Allocating from a group whose bitmap is known-inconsistent hands the attacker\u0027s file blocks that are still referenced by other inodes \\u2014 the double-free detector\u0027s case is exactly \\\"this block is still owned by another file\\\" \\u2014 so simply reading the attacker\u0027s own new file discloses other users\u0027 and system files\u0027 on-disk contents.\\nI:H - The same double allocation lets attacker-controlled writes land on blocks belonging to other users\u0027 files and, where the bitmap accounting is wrong for metadata blocks, on ext4 metadata (inode table, bitmaps), corrupting foreign data and inode fields in a way that is leverageable for privilege escalation.\\nA:H - Operating on the inconsistent buddy triggers `BUG_ON(ord \u003c= 0)` / `BUG_ON((start \u003e\u003e ord) \u003e= max)` in `mb_mark_used()`, `bb_free`/`bb_fragments` underflow feeding the divide-by-zero in `mb_update_avg_fragment_size()`, and `ext4_grp_locked_error()`, which forces the filesystem read-only by default and panics the kernel with `errors=panic`.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"163a203ddb36c36d4a1c942aececda0cc8d06aa7\", \"lessThan\": \"21f8cfe79f776287459343e9cfa6055af61328ea\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"163a203ddb36c36d4a1c942aececda0cc8d06aa7\", \"lessThan\": \"260fc96283c0f594de18a1b045faf6d8fb42874d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"163a203ddb36c36d4a1c942aececda0cc8d06aa7\", \"lessThan\": \"927794a02169778c9c2e7b25c768ab3ea8c1dc03\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"163a203ddb36c36d4a1c942aececda0cc8d06aa7\", \"lessThan\": \"4c21fa60a6f4606f6214a38f50612b17b2f738f5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"163a203ddb36c36d4a1c942aececda0cc8d06aa7\", \"lessThan\": \"f97e75fa4e12b0aa0224e83fcbda8853ac2adf36\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"163a203ddb36c36d4a1c942aececda0cc8d06aa7\", \"lessThan\": \"0184747b552d6b5a14db3b7fcc3b792ce64dedd1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"163a203ddb36c36d4a1c942aececda0cc8d06aa7\", \"lessThan\": \"a2576ae9a35c078e488f2c573e9e6821d651fbbe\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"163a203ddb36c36d4a1c942aececda0cc8d06aa7\", \"lessThan\": \"4530b3660d396a646aad91a787b6ab37cf604b53\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/ext4/mballoc.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.308\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.270\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.211\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.150\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.80\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.19\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/ext4/mballoc.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/21f8cfe79f776287459343e9cfa6055af61328ea\"}, {\"url\": \"https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d\"}, {\"url\": \"https://git.kernel.org/stable/c/927794a02169778c9c2e7b25c768ab3ea8c1dc03\"}, {\"url\": \"https://git.kernel.org/stable/c/4c21fa60a6f4606f6214a38f50612b17b2f738f5\"}, {\"url\": \"https://git.kernel.org/stable/c/f97e75fa4e12b0aa0224e83fcbda8853ac2adf36\"}, {\"url\": \"https://git.kernel.org/stable/c/0184747b552d6b5a14db3b7fcc3b792ce64dedd1\"}, {\"url\": \"https://git.kernel.org/stable/c/a2576ae9a35c078e488f2c573e9e6821d651fbbe\"}, {\"url\": \"https://git.kernel.org/stable/c/4530b3660d396a646aad91a787b6ab37cf604b53\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\next4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()\\n\\nDetermine if the group block bitmap is corrupted before using ac_b_ex in\\next4_mb_try_best_found() to avoid allocating blocks from a group with a\\ncorrupted block bitmap in the following concurrency and making the\\nsituation worse.\\n\\next4_mb_regular_allocator\\n  ext4_lock_group(sb, group)\\n  ext4_mb_good_group\\n   // check if the group bbitmap is corrupted\\n  ext4_mb_complex_scan_group\\n   // Scan group gets ac_b_ex but doesn\u0027t use it\\n  ext4_unlock_group(sb, group)\\n                           ext4_mark_group_bitmap_corrupted(group)\\n                           // The block bitmap was corrupted during\\n                           // the group unlock gap.\\n  ext4_mb_try_best_found\\n    ext4_lock_group(ac-\u003eac_sb, group)\\n    ext4_mb_use_best_found\\n      mb_mark_used\\n      // Allocating blocks in block bitmap corrupted group\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.308\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.270\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.211\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.150\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.80\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.19\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.7\", \"versionStartIncluding\": \"3.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"3.12\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:27:10.867Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-26773\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:27:10.867Z\", \"dateReserved\": \"2024-02-19T14:20:24.176Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-04-03T17:00:59.757Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.