CVE-2024-49966
ocfs2: cancel dqi_sync_work before freeing oinfo
Using Linux by Linux?
Get instant alerts when new vulnerabilities affect Linux - before attackers find them.
Description
In the Linux kernel, the following vulnerability has been resolved: ocfs2: cancel dqi_sync_work before freeing oinfo ocfs2_global_read_info() will initialize and schedule dqi_sync_work at the end, if error occurs after successfully reading global quota, it will trigger the following warning with CONFIG_DEBUG_OBJECTS_* enabled: ODEBUG: free active (active state 0) object: 00000000d8b0ce28 object type: timer_list hint: qsync_work_fn+0x0/0x16c This reports that there is an active delayed work when freeing oinfo in error handling, so cancel dqi_sync_work first. BTW, return status instead of -1 when .read_file_info fails.
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- https://git.kernel.org/stable/c/0d707a33c84b371cb66120e198eed3374726ddd8
- https://git.kernel.org/stable/c/14114d8148db07e7946fb06b56a50cfa425e26c7
- https://git.kernel.org/stable/c/35fccce29feb3706f649726d410122dd81b92c18
- https://git.kernel.org/stable/c/4173d1277c00baeedaaca76783e98b8fd0e3c08d
- https://git.kernel.org/stable/c/89043e7ed63c7fc141e68ea5a79758ed24b6c699
References (11)
SSVC — Action Prioritization
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
Quick Info
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.