CVE-2024-39469

nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors

HIGH
7.1
CVSS Score
Published: June 25, 2024 at 02:28 PM UTC
Updated: October 15, 2026 at 01:18 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.1
Exploit prediction
EPSS 0.3%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors The error handling in nilfs_empty_dir() when a directory folio/page read fails is incorrect, as in the old ext2 implementation, and if the folio/page cannot be read or nilfs_check_folio() fails, it will falsely determine the directory as empty and corrupt the file system. In addition, since nilfs_empty_dir() does not immediately return on a failed folio/page read, but continues to loop, this can cause a long loop with I/O if i_size of the directory's inode is also corrupted, causing the log writer thread to wait and hang, as reported by syzbot. Fix these issues by making nilfs_empty_dir() immediately return a false value (0) if it fails to get a directory folio/page.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

2.6.30 ≤ v < 4.19.3174.20 ≤ v < 5.4.2795.11 ≤ v < 5.15.1625.16 ≤ v < 6.1.955.5 ≤ v < 5.10.2216.2 ≤ v < 6.6.356.7 ≤ v < 6.9.52ba466d74ed74f073257f86e61519cb8f8f461846.106.10 rc16.10 rc2
Vendor states this is fixed in 11a2edb70356a2202dcb7c9c189c8356ab4752cd (fixed)
Vendor states this is fixed in 129dcd3e7d036218db3f59c82d82004b9539ed82 (fixed)
Vendor states this is fixed in 2ac8a2fe22bdde9eecce2a42cf5cab79333fb428 (fixed)
Vendor states this is fixed in 405b71f1251e5ae865f53bd27c45114e6c83bee3 (fixed)
Vendor states this is fixed in 59f14875a96ef93f05b82ad3c980605f2cb444b5 (fixed)
Vendor states this is fixed in 7373a51e7998b508af7136530f3a997b286ce81c (fixed)
Vendor states this is fixed in c77ad608df6c091fe64ecb91f41ef7cb465587f1 (fixed)
Vendor states this is fixed in d18b05eda7fa77f02114f15b02c009f28ee42346 (fixed)
Vendor states this is fixed in 2.6.30 (unaffected)
Vendor states this is fixed in 4.19.317 (unaffected)
Vendor states this is fixed in 5.10.221 (unaffected)
Vendor states this is fixed in 5.15.162 (unaffected)
Vendor states this is fixed in 5.4.279 (unaffected)
Vendor states this is fixed in 6.1.95 (unaffected)
Vendor states this is fixed in 6.10 (unaffected)
Vendor states this is fixed in 6.6.35 (unaffected)
Vendor states this is fixed in 6.9.5 (unaffected)

References (11)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/11a2edb70356a2202dcb7c9c189c8356ab4752cd
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/129dcd3e7d036218db3f59c82d82004b9539ed82
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/2ac8a2fe22bdde9eecce2a42cf5cab79333fb428
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/405b71f1251e5ae865f53bd27c45114e6c83bee3
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/59f14875a96ef93f05b82ad3c980605f2cb444b5
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7373a51e7998b508af7136530f3a997b286ce81c
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c77ad608df6c091fe64ecb91f41ef7cb465587f1
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d18b05eda7fa77f02114f15b02c009f28ee42346

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.1HIGHLinux
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card