CVE-2024-49877
ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
MEDIUM
5.5
CVSS Score
Published: October 21, 2024 at 06:01 PM UTC
Updated: June 17, 2026 at 08:00 AM UTC
1 product affected across 1 vendorLinux Kernel
Using Linux by Linux?
Get instant alerts when new vulnerabilities affect Linux - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.3%
SSVC
No known exploit
Description
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate When doing cleanup, if flags without OCFS2_BH_READAHEAD, it may trigger NULL pointer dereference in the following ocfs2_set_buffer_uptodate() if bh is NULL.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
v ≥ 4.14.157v ≥ 4.4.204v ≥ 4.9.2044.14.157 ≤ v < 4.154.19.87 ≤ v < 4.19.3234.20 ≤ v < 5.10.2274.20 ≤ v < 5.15.1684.20 ≤ v < 5.4.2854.20 ≤ v < 6.1.1134.20 ≤ v < 6.10.144.20 ≤ v < 6.11.34.20 ≤ v < 6.124.20 ≤ v < 6.6.554.4.204 ≤ v < 4.54.9.204 ≤ v < 4.105.11 ≤ v < 5.15.1685.16 ≤ v < 6.1.1136.11 ≤ v < 6.11.36.2 ≤ v < 6.6.556.7 ≤ v < 6.10.141f93d5e36753fc4d6ec67f5ce78c9c6f2dd564.14.1574.19.874.4.2044.9.20465cbd1279f4b999d56a838344a30642db24cd2156c150df9c2e80b5cf86f5a0d98beb7390ad63bfc97e1db17bc1ef4c2e1789bc9323c7be44fba53f8cf76c78595ca87548ca5e45c862ac9e0949c4687
Vendor states this is fixed in 01cb2e751cc61ade454c9bc1aaa2eac1f8197112 (fixed)
Vendor states this is fixed in 190d98bcd61117a78fe185222d162180f061a6ca (fixed)
Vendor states this is fixed in 33b525cef4cff49e216e4133cc48452e11c0391e (fixed)
Vendor states this is fixed in 46b1edf0536a5291a8ad2337f88c926214b209d9 (fixed)
Vendor states this is fixed in 4846e72ab5a0726e49ad4188b9d9df091ae78c64 (fixed)
Vendor states this is fixed in 61b84013e560382cbe7dd56758be3154d43a3988 (fixed)
Vendor states this is fixed in d52c5652e7dcb7a0648bbb8642cc3e617070ab49 (fixed)
Vendor states this is fixed in df944dc46d06af65a75191183d52be017e6b9dbe (fixed)
Vendor states this is fixed in e68c8323355e8cedfbe0bec7d5a39009f61640b6 (fixed)
Affected range stops below 4.10, so it looks safe — our inference, not a vendor statement
Affected range stops below 4.15, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 4.19.323 (unaffected)
Vendor states this is fixed in 4.20 (unaffected)
Affected range stops below 4.5, so it looks safe — our inference, not a vendor statement
Vendor states this is fixed in 5.10.227 (unaffected)
Vendor states this is fixed in 5.15.168 (unaffected)
Vendor states this is fixed in 5.4.285 (unaffected)
Vendor states this is fixed in 6.1.113 (unaffected)
Vendor states this is fixed in 6.10.14 (unaffected)
Vendor states this is fixed in 6.11.3 (unaffected)
Vendor states this is fixed in 6.12 (unaffected)
Vendor states this is fixed in 6.6.55 (unaffected)
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- https://git.kernel.org/stable/c/01cb2e751cc61ade454c9bc1aaa2eac1f8197112
- https://git.kernel.org/stable/c/33b525cef4cff49e216e4133cc48452e11c0391e
- https://git.kernel.org/stable/c/46b1edf0536a5291a8ad2337f88c926214b209d9
- https://git.kernel.org/stable/c/4846e72ab5a0726e49ad4188b9d9df091ae78c64
- https://git.kernel.org/stable/c/61b84013e560382cbe7dd56758be3154d43a3988
References (11)
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/01cb2e751cc61ade454c9bc1aaa2eac1f8197112Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/190d98bcd61117a78fe185222d162180f061a6caPatch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/33b525cef4cff49e216e4133cc48452e11c0391ePatch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/46b1edf0536a5291a8ad2337f88c926214b209d9Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/4846e72ab5a0726e49ad4188b9d9df091ae78c64Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/61b84013e560382cbe7dd56758be3154d43a3988Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d52c5652e7dcb7a0648bbb8642cc3e617070ab49Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/df944dc46d06af65a75191183d52be017e6b9dbeSSVC — Action Prioritization
SSVCNo known exploitNot automatablePartial impact
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
- Attack Vector
- LOCAL
- Complexity
- LOW
- Privileges
- LOW
- User Interaction
- NONE
- Scope
- UNCHANGED
- Confidentiality
- NONE
- Integrity
- NONE
- Availability
- HIGH
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-476
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card