CVE-2024-40972: ext4: do not create EA inode under buffer lock
In the Linux kernel, the following vulnerability has been resolved:
ext4: do not create EA inode under buffer lock
ext4xattrsetentry() creates new EA inodes while holding buffer lock on the external xattr block. This is problematic as it nests all the allocation locking (which acquires locks on other buffers) under the buffer lock. This can even deadlock when the filesystem is corrupted and e.g. quota file is setup to contain xattr block as data block. Move the allocation of EA inode out of ext4xattrsetentry() into the callers.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40972?
CVE-2024-40972 has been assigned a medium severity, indicating a moderate impact on systems in which it exists.
How do I fix CVE-2024-40972?
To fix CVE-2024-40972, update the Linux kernel to versions 6.9.7, 6.10, or apply the indicated patches for the affected distributions.
Which Linux kernel versions are affected by CVE-2024-40972?
CVE-2024-40972 affects Linux kernel versions prior to 6.9.7 and certain earlier 6.x versions.
Is CVE-2024-40972 exploitable remotely?
Currently, there is no information indicating that CVE-2024-40972 is remotely exploitable.
What type of vulnerability is CVE-2024-40972?
CVE-2024-40972 is a vulnerability in the ext4 filesystem related to inode handling under buffer locks.