CVE-2024-26601
About
In the Linux kernel, the following vulnerability has been resolved:
ext4: regenerate buddy after block freeing failed if under fc replay
This mostly reverts commit 6bd97bf273bd ("ext4: remove redundant
mb_regenerate_buddy()") and reintroduces mb_regenerate_buddy(). Based on
code in mb_free_blocks(), fast commit replay can end up marking as free
blocks that are already marked as such. This causes corruption of the
buddy bitmap so we need to regenerate it in that case.
Rainforest analyst review
This is a Linux kernel correctness fix in ext4, not a classic exploit primitive. Under fast-commit replay, the block-freeing path could mark already-free blocks as free again, corrupting the buddy bitmap; the patch reinstates the regeneration step that keeps the allocator's view consistent. The observable risk is availability, a local low-privileged process able to trigger the corruption path.
There's no remote angle, no privilege gain, and no data theft here, and exploiting it deliberately means driving a fairly specific filesystem-recovery code path from a local account. That makes it far more of a stability and data-integrity concern than a security emergency; in practice it matters most on systems that actually exercise fast commit and where an untrusted local workload runs.
We deliberately rank this near the bottom of the batch and treat it as ordinary kernel hygiene. It rides in on the normal distribution-kernel update stream rather than an out-of-band push. The only place we'd raise it is a host that combines ext4 fast commit with genuinely untrusted local tenants, where a self-inflicted denial of service carries real cost.
References
- https://git.kernel.org/stable/c/6b0d48647935e4b8c7b75d1eccb9043fcd4ee581
- https://git.kernel.org/stable/c/78327acd4cdc4a1601af718b781eece577b6b7d4
- https://git.kernel.org/stable/c/94ebf71bddbcd4ab1ce43ae32c6cb66396d2d51a
- https://git.kernel.org/stable/c/c1317822e2de80e78f137d3a2d99febab1b80326
- https://git.kernel.org/stable/c/c9b528c35795b711331ed36dc3dbee90d5812d4e
- https://git.kernel.org/stable/c/ea42d6cffb0dd27a417f410b9d0011e9859328cb
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
Related CVEs
No related CVEs.
Frequently asked questions
What is CVE-2024-26601?
In the Linux kernel, the following vulnerability has been resolved: ext4: regenerate buddy after block freeing failed if under fc replay This mostly reverts commit 6bd97bf273bd ("ext4: remove redundant mb_regenerate_buddy()") and reintroduces mb_regenerate_buddy(). Based on code in mb_free_blocks(), fast commit replay can end up marking as free blocks that are already marked as such.
How severe is CVE-2024-26601?
CVE-2024-26601 carries a CVSS 3.1 base score of 5.5, rated medium. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 49 out of 100, in the moderate band.
How is CVE-2024-26601 exploited?
According to the CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H): attack vector Local, attack complexity Low, privileges required Low, user interaction None. Impact on confidentiality None, integrity None and availability High.
Which products are affected by CVE-2024-26601?
Public advisories list the following as affected: linux kernel. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2024-26601?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.