{"dataType":"CVE_RECORD","cveMetadata":{"cveId":"CVE-2024-26773","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-02-19T14:20:24.176Z","datePublished":"2024-04-03T17:00:59.757Z","dateUpdated":"2026-08-05T11:27:10.867Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:27:10.867Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()\n\nDetermine if the group block bitmap is corrupted before using ac_b_ex in\next4_mb_try_best_found() to avoid allocating blocks from a group with a\ncorrupted block bitmap in the following concurrency and making the\nsituation worse.\n\next4_mb_regular_allocator\n  ext4_lock_group(sb, group)\n  ext4_mb_good_group\n   // check if the group bbitmap is corrupted\n  ext4_mb_complex_scan_group\n   // Scan group gets ac_b_ex but doesn't use it\n  ext4_unlock_group(sb, group)\n                           ext4_mark_group_bitmap_corrupted(group)\n                           // The block bitmap was corrupted during\n                           // the group unlock gap.\n  ext4_mb_try_best_found\n    ext4_lock_group(ac->ac_sb, group)\n    ext4_mb_use_best_found\n      mb_mark_used\n      // Allocating blocks in block bitmap corrupted group"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable allocator is reached only through local filesystem operations (`write()`, `fallocate()`, truncate/extend) on a mounted ext4 filesystem via `ext4_mb_new_blocks()` → `ext4_mb_regular_allocator()`. No network protocol handler parses data that reaches this code directly.\nAC:L - The attacker drives both sides of the window — many concurrent writer threads on the same block group both create the allocation pressure that forces the `ac_b_ex.fe_len > 0 && !AC_STATUS_FOUND` fallback into `ext4_mb_try_best_found()` and supply the concurrent free/scan that flags the group corrupt — and the same-thread path (corruption detected inside `ext4_mb_complex_scan_group()`, `break`, then the fallback allocation) needs no race at all; the sequence can be retried indefinitely at no cost.\nPR:L - Only an unprivileged local account with write access to any ext4 mount (`/tmp`, `/home`, an app data partition on Android/embedded) is needed; no capability, mount privilege, or fs-specific permission is consulted on the allocation path.\nUI:N - Once a group is flagged corrupt — by media aging on eMMC/flash in embedded and automotive deployments, by a prior detected double-free, or by the free-count mismatch the attacker's own concurrent allocation traffic provokes — exploitation is entirely the attacker's own syscalls, with no victim mount or file access required.\nS:U - The damaged resources are the ext4 block bitmap, buddy state, and file data, all managed by the same kernel security authority as the vulnerable code; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - Allocating from a group whose bitmap is known-inconsistent hands the attacker's file blocks that are still referenced by other inodes — the double-free detector's case is exactly \"this block is still owned by another file\" — so simply reading the attacker's own new file discloses other users' and system files' on-disk contents.\nI:H - The same double allocation lets attacker-controlled writes land on blocks belonging to other users' files and, where the bitmap accounting is wrong for metadata blocks, on ext4 metadata (inode table, bitmaps), corrupting foreign data and inode fields in a way that is leverageable for privilege escalation.\nA:H - Operating on the inconsistent buddy triggers `BUG_ON(ord <= 0)` / `BUG_ON((start >> ord) >= max)` in `mb_mark_used()`, `bb_free`/`bb_fragments` underflow feeding the divide-by-zero in `mb_update_avg_fragment_size()`, and `ext4_grp_locked_error()`, which forces the filesystem read-only by default and panics the kernel with `errors=panic`."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ext4/mballoc.c"],"versions":[{"version":"163a203ddb36c36d4a1c942aececda0cc8d06aa7","lessThan":"21f8cfe79f776287459343e9cfa6055af61328ea","status":"affected","versionType":"git"},{"version":"163a203ddb36c36d4a1c942aececda0cc8d06aa7","lessThan":"260fc96283c0f594de18a1b045faf6d8fb42874d","status":"affected","versionType":"git"},{"version":"163a203ddb36c36d4a1c942aececda0cc8d06aa7","lessThan":"927794a02169778c9c2e7b25c768ab3ea8c1dc03","status":"affected","versionType":"git"},{"version":"163a203ddb36c36d4a1c942aececda0cc8d06aa7","lessThan":"4c21fa60a6f4606f6214a38f50612b17b2f738f5","status":"affected","versionType":"git"},{"version":"163a203ddb36c36d4a1c942aececda0cc8d06aa7","lessThan":"f97e75fa4e12b0aa0224e83fcbda8853ac2adf36","status":"affected","versionType":"git"},{"version":"163a203ddb36c36d4a1c942aececda0cc8d06aa7","lessThan":"0184747b552d6b5a14db3b7fcc3b792ce64dedd1","status":"affected","versionType":"git"},{"version":"163a203ddb36c36d4a1c942aececda0cc8d06aa7","lessThan":"a2576ae9a35c078e488f2c573e9e6821d651fbbe","status":"affected","versionType":"git"},{"version":"163a203ddb36c36d4a1c942aececda0cc8d06aa7","lessThan":"4530b3660d396a646aad91a787b6ab37cf604b53","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/ext4/mballoc.c"],"versions":[{"version":"3.12","status":"affected"},{"version":"0","lessThan":"3.12","status":"unaffected","versionType":"semver"},{"version":"4.19.308","lessThanOrEqual":"4.19.*","status":"unaffected","versionType":"semver"},{"version":"5.4.270","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.211","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.150","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.80","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.19","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.7.7","lessThanOrEqual":"6.7.*","status":"unaffected","versionType":"semver"},{"version":"6.8","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"4.19.308"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"5.4.270"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"5.10.211"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"5.15.150"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"6.1.80"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"6.6.19"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"6.7.7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.12","versionEndExcluding":"6.8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/21f8cfe79f776287459343e9cfa6055af61328ea"},{"url":"https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d"},{"url":"https://git.kernel.org/stable/c/927794a02169778c9c2e7b25c768ab3ea8c1dc03"},{"url":"https://git.kernel.org/stable/c/4c21fa60a6f4606f6214a38f50612b17b2f738f5"},{"url":"https://git.kernel.org/stable/c/f97e75fa4e12b0aa0224e83fcbda8853ac2adf36"},{"url":"https://git.kernel.org/stable/c/0184747b552d6b5a14db3b7fcc3b792ce64dedd1"},{"url":"https://git.kernel.org/stable/c/a2576ae9a35c078e488f2c573e9e6821d651fbbe"},{"url":"https://git.kernel.org/stable/c/4530b3660d396a646aad91a787b6ab37cf604b53"}],"title":"ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-26773","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-04-03T18:50:26.209110Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-06-04T17:49:10.181Z"}},{"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2024-08-02T00:14:13.512Z"},"title":"CVE Program Container","references":[{"url":"https://git.kernel.org/stable/c/21f8cfe79f776287459343e9cfa6055af61328ea","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/260fc96283c0f594de18a1b045faf6d8fb42874d","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/927794a02169778c9c2e7b25c768ab3ea8c1dc03","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/4c21fa60a6f4606f6214a38f50612b17b2f738f5","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/f97e75fa4e12b0aa0224e83fcbda8853ac2adf36","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/0184747b552d6b5a14db3b7fcc3b792ce64dedd1","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/a2576ae9a35c078e488f2c573e9e6821d651fbbe","tags":["x_transferred"]},{"url":"https://git.kernel.org/stable/c/4530b3660d396a646aad91a787b6ab37cf604b53","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html","tags":["x_transferred"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html","tags":["x_transferred"]}]}]},"dataVersion":"5.2"}