CVE-2024-38583

nilfs2: fix use-after-free of timer for log writer thread

HIGH

7.8

CVSS Score

Published: June 19, 2024 at 01:37 PM UTC

Updated: August 5, 2026 at 12:04 PM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free of timer for log writer thread Patch series "nilfs2: fix log writer related issues". This bug fix series covers three nilfs2 log writer-related issues, including a timer use-after-free issue and potential deadlock issue on unmount, and a potential freeze issue in event synchronization found during their analysis. Details are described in each commit log. This patch (of 3): A use-after-free issue has been reported regarding the timer sc_timer on the nilfs_sc_info structure. The problem is that even though it is used to wake up a sleeping log writer thread, sc_timer is not shut down until the nilfs_sc_info structure is about to be freed, and is used regardless of the thread's lifetime. Fix this issue by limiting the use of sc_timer only while the log writer thread is alive.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

2.6.35 ≤ v < 4.19.3162.6.35 ≤ v < 5.10.2192.6.35 ≤ v < 5.15.1612.6.35 ≤ v < 5.4.2782.6.35 ≤ v < 6.1.942.6.35 ≤ v < 6.102.6.35 ≤ v < 6.6.332.6.35 ≤ v < 6.8.122.6.35 ≤ v < 6.9.34.20 ≤ v < 5.4.2785.11 ≤ v < 5.15.1615.16 ≤ v < 6.1.945.5 ≤ v < 5.10.2196.2 ≤ v < 6.6.336.7 ≤ v < 6.8.126.9 ≤ v < 6.9.32.6.35fdce895ea5dd4e24edf1f4d693827349a4e5b3b4

Vendor states this is fixed in 2f12b2c03c5dae1a0de0a9e5853177e3d6eee3c6 (fixed)

Vendor states this is fixed in 67fa90d4a2ccd9ebb0e1e168c7d0b5d0cf3c7148 (fixed)

Vendor states this is fixed in 68e738be5c518fc3c4e9146b66f67c8fee0135fb (fixed)

Vendor states this is fixed in 822ae5a8eac30478578a75f7e064f0584931bf2d (fixed)

Vendor states this is fixed in 82933c84f188dcfe89eb26b0b48ab5d1ca99d164 (fixed)

Vendor states this is fixed in 86a30d6302deddb9fb97ba6fc4b04d0e870b582a (fixed)

Vendor states this is fixed in e65ccf3a4de4f0c763d94789615b83e11f204438 (fixed)

Vendor states this is fixed in f5d4e04634c9cf68bdf23de08ada0bb92e8befe7 (fixed)

Vendor states this is fixed in f9186bba4ea282b07293c1c892441df3a5441cb0 (fixed)

Vendor states this is fixed in 2.6.35 (unaffected)

Vendor states this is fixed in 4.19.316 (unaffected)

Vendor states this is fixed in 5.10.219 (unaffected)

Vendor states this is fixed in 5.15.161 (unaffected)

Vendor states this is fixed in 5.4.278 (unaffected)

Vendor states this is fixed in 6.1.94 (unaffected)

Vendor states this is fixed in 6.10 (unaffected)

Vendor states this is fixed in 6.6.33 (unaffected)

Vendor states this is fixed in 6.8.12 (unaffected)

Vendor states this is fixed in 6.9.3 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references