PT-2024-21601 · Linux+4 · Linux Kernel+4
Published
2024-04-30
·
Updated
2025-02-03
·
CVE-2024-26972
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A vulnerability has been resolved in the Linux kernel, specifically in the ubifs symlink function, where a memleak of inode->i link occurs in the error path. This happens when the inode is marked as bad and then iput() is invoked. If inode->i link is initialized by fscrypt encrypt symlink() in an encryption scenario, it won't be freed by the callchain ubifs free inode -> fscrypt free inode in the error handling path. This is because make bad inode() has changed 'inode->i mode' to 'S IFREG'. The vulnerability can be reproduced by injecting an error in ubifs jnl update() when doing a symlink in an encryption scenario.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Linux Kernel
Suse
Ubuntu