PT-2024-32734 · Linux+10 · Linux Kernel+10
Published
2024-08-23
·
Updated
2025-11-12
·
CVE-2024-47679
CVSS v3.1
4.7
Medium
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.58
Description
The issue is related to a race condition between
evice inodes() and find inode()&iput() in the Linux kernel's Virtual File System (VFS). This occurs when there are concurrent threads calling iput() and generic shutdown super(), leading to a situation where two threads may simultaneously evict the same inode. This can trigger a bug statement within clear inode() and iput(). The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.Technical details about exploitation include:
- API Endpoints: None specified.
- Vulnerable Parameters or Variables:
inode->i count,I FREEING,I WILL FREE,I NEW. - Function Names:
iput(),find inode(),generic shutdown super(),clear inode(),iget(),inode add lru(),evict inodes().
Recommendations
To resolve the issue, update the Linux kernel to version 6.6.58 or later. As a temporary workaround, consider rechecking the
inode->i count after holding i lock to reduce the overhead of spin lock(). Restrict access to the vulnerable btrfs iget() function to minimize the risk of exploitation. Avoid using the inode variable in the affected API endpoints until the issue is resolved.Exploit
Fix
Improper Locking
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu