CVE-2024-26630

mm: cachestat: fix folio read-after-free in cache walk

HIGH
7.1
CVSS Score
Published: March 13, 2024 at 03:50 PM UTC
Updated: August 5, 2026 at 12:04 PM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.1
Exploit prediction
EPSS 0.3%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: mm: cachestat: fix folio read-after-free in cache walk In cachestat, we access the folio from the page cache's xarray to compute its page offset, and check for its dirty and writeback flags. However, we do not hold a reference to the folio before performing these actions, which means the folio can concurrently be released and reused as another folio/page/slab. Get around this altogether by just using xarray's existing machinery for the folio page offsets and dirty/writeback states. This changes behavior for tmpfs files to now always report zeroes in their dirty and writeback counters. This is okay as tmpfs doesn't follow conventional writeback cache behavior: its pages get "cleaned" during swapout, after which they're no longer resident etc.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

6.5 ≤ v < 6.6.216.5 ≤ v < 6.7.96.5 ≤ v < 6.86.7 ≤ v < 6.7.96.8 rc16.8 rc26.8 rc36.8 rc46.8 rc56.8 rc6cf264e1329fb0307e044f7675849f9f38b44c11a
Vendor states this is fixed in 3a75cb05d53f4a6823a32deb078de1366954a804 (fixed)
Vendor states this is fixed in ba60fdf75e89ea762bb617be578dc47f27655117 (fixed)
Vendor states this is fixed in fe7e008e0ce728252e4ec652cceebcc62211657c (fixed)
Vendor states this is fixed in 6.5 (unaffected)
Vendor states this is fixed in 6.6.21 (unaffected)
Vendor states this is fixed in 6.7.9 (unaffected)
Vendor states this is fixed in 6.8 (unaffected)

References (3)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3a75cb05d53f4a6823a32deb078de1366954a804
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ba60fdf75e89ea762bb617be578dc47f27655117
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/fe7e008e0ce728252e4ec652cceebcc62211657c

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.1HIGHLinux
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-416

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card