CVE-2024-40972

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-40972
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-40972.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-40972
Downstream
Related
Published
2024-07-12T12:32:10.102Z
Modified
2026-03-20T12:37:26.440832Z
Summary
ext4: do not create EA inode under buffer lock
Details

In the Linux kernel, the following vulnerability has been resolved:

ext4: do not create EA inode under buffer lock

ext4xattrsetentry() creates new EA inodes while holding buffer lock on the external xattr block. This is problematic as it nests all the allocation locking (which acquires locks on other buffers) under the buffer lock. This can even deadlock when the filesystem is corrupted and e.g. quota file is setup to contain xattr block as data block. Move the allocation of EA inode out of ext4xattrsetentry() into the callers.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/40xxx/CVE-2024-40972.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
e50e5129f384ae282adebfb561189cdb19b81cee
Fixed
0752e7fb549d90c33b4d4186f11cfd25a556d1dd
Fixed
737fb7853acd5bc8984f6f42e4bfba3334be8ae1
Fixed
111103907234bffd0a34fba070ad9367de058752
Fixed
0a46ef234756dca04623b7591e8ebb3440622f0b

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-40972.json"