PT-2024-4121 · Linux+3 · Linux Kernel+3
Published
2024-04-28
·
Updated
2026-05-26
·
CVE-2024-36966
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.37
Description
The issue is related to the
erofs kill sb() function in the Linux kernel, which can lead to an attempt to free an anon dev that has never been allocated when CONFIG EROFS FS ONDEMAND is enabled. This triggers a warning and can cause problems. The erofs kill sb() function is called in block dev based mode, and s bdev may not have been initialized yet. To fix this, erofs sb info must be initialized, and sbi->fsid is used to distinguish between block based and fscache mode.Recommendations
Update to Linux kernel version 6.6.37 or later to resolve the issue. As a temporary workaround, consider disabling the
CONFIG EROFS FS ONDEMAND configuration option until a patch is available.Exploit
Fix
Access of Uninitialized Pointer
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Linux Kernel
Ubuntu