CVE-2024-27058

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-27058
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-27058.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-27058
Downstream
Published
2024-05-01T13:00:06.852Z
Modified
2025-11-30T19:14:30.589251Z
Severity
  • 4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
tmpfs: fix race on handling dquot rbtree
Details

In the Linux kernel, the following vulnerability has been resolved:

tmpfs: fix race on handling dquot rbtree

A syzkaller reproducer found a race while attempting to remove dquot information from the rb tree.

Fetching the rbtree root node must also be protected by the dqopt->dqiosem, otherwise, giving the right timing, shmemreleasedquot() will trigger a warning because it couldn't find a node in the tree, when the real reason was the root node changing before the search starts:

Thread 1 Thread 2 - shmemreleasedquot() - shmem{acquire,release}dquot()

  • fetch ROOT - Fetch ROOT

                - acquire dqio_sem

  • wait dqio_sem

                - do something, triger a tree rebalance
            - release dqio_sem

  • acquire dqio_sem

  • start searching for the node, but from the wrong location, missing the node, and triggering a warning.
Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27058.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
eafc474e202978ac735c551d5ee1eb8c02e2be54
Fixed
c7077f43f30d817d10a9f8245e51576ac114b2f0
Fixed
617d55b90e73c7b4aa2733ca6cc3f9b72d1124bb
Fixed
f82f184874d2761ebaa60dccf577921a0dbb3810
Fixed
0a69b6b3a026543bc215ccc866d0aea5579e6ce2

Affected versions

v6.*

v6.5
v6.5-rc5
v6.5-rc6
v6.5-rc7
v6.6
v6.6-rc1
v6.6-rc2
v6.6-rc3
v6.6-rc4
v6.6-rc5
v6.6-rc6
v6.6-rc7
v6.6.1
v6.6.10
v6.6.11
v6.6.12
v6.6.13
v6.6.14
v6.6.15
v6.6.16
v6.6.17
v6.6.18
v6.6.19
v6.6.2
v6.6.20
v6.6.21
v6.6.22
v6.6.23
v6.6.3
v6.6.4
v6.6.5
v6.6.6
v6.6.7
v6.6.8
v6.6.9
v6.7
v6.7-rc1
v6.7-rc2
v6.7-rc3
v6.7-rc4
v6.7-rc5
v6.7-rc6
v6.7-rc7
v6.7-rc8
v6.7.1
v6.7.10
v6.7.11
v6.7.2
v6.7.3
v6.7.4
v6.7.5
v6.7.6
v6.7.7
v6.7.8
v6.7.9
v6.8
v6.8-rc1
v6.8-rc2
v6.8-rc3
v6.8-rc4
v6.8-rc5
v6.8-rc6
v6.8-rc7
v6.8.1
v6.8.2
v6.9-rc1

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-27058.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
6.6.0
Fixed
6.6.24
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.7.12
Type
ECOSYSTEM
Events
Introduced
6.8.0
Fixed
6.8.3

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-27058.json"