CVE-2024-26981·Kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix OOB in nilfs_set_de_type The size of the nilfs_type_by_mode array in the fs/nilfs2/dir.c file is defined as "S_IFMT >> S_SHIFT", but the nilfs_set_de_type() function, which uses this array, specifies the index to read from the array in the same way as "(mode & S_IFMT) >> S_SHIFT". static void nilfs_set_de_type(struct nilfs_dir_entry *de, struct inode *inode) { umode_t mode = inode->i_mode; de->file_type = nilfs_type_by_mode[(mode & S_IFMT)>>S_SHIFT]; // oob } However, when the index is determined this way, an out-of-bounds (OOB) error occurs by referring to an index that is 1 larger than the array size when the condition "mode & S_IFMT == S_IFMT" is satisfied. Therefore, a patch to resize the nilfs_type_by_mode array should be applied to prevent OOB errors.
- Severity
- high
- Software
- Kernel
- Fixed in
- 6.8.8
- Published
- 2024-05-01
Affected versions
From: 6.7
Until: 6.8.8
Fixed in: 6.8.8
How to fix this CVE
Update the Linux kernel to version 6.8.8 or later to resolve an out-of-bounds memory access vulnerability in the nilfs2 filesystem driver. This vulnerability affects the directory entry type assignment function and can lead to kernel memory corruption. Systems running vulnerable kernel versions (6.7 through 6.8.7) should prioritize this update, particularly those using nilfs2 as a filesystem.
sudo dnf update kernel kernel-develDefensia detects this vulnerability
How to check if you are affected
- Check current kernel version: uname -r
- Verify if nilfs2 filesystem is in use: mount | grep nilfs2 or cat /proc/filesystems | grep nilfs2
- Review kernel logs for memory access errors: dmesg | grep -i 'oob\|out.of.bounds\|memory'
- Confirm kernel has been updated: uname -r should show version 6.8.8 or later
FAQ
What is CVE-2024-26981?
This is an out-of-bounds memory read vulnerability in the Linux kernel's nilfs2 filesystem implementation. The flaw occurs in the nilfs_set_de_type() function when processing directory entries with certain file mode values, potentially causing kernel memory corruption or information disclosure.
Is CVE-2024-26981 being actively exploited?
No, there is no evidence of active exploitation in the wild. The vulnerability requires local filesystem access and is not listed in the CISA Known Exploited Vulnerabilities catalog.
What versions of Kernel are affected by CVE-2024-26981?
Linux kernel versions 6.7 through 6.8.7 are affected. The vulnerability has been patched in kernel version 6.8.8 and later.
How do I check if my server is vulnerable to CVE-2024-26981?
Run 'uname -r' to check your kernel version. If it shows 6.7.x through 6.8.7, and your system uses nilfs2 filesystem (verify with 'mount | grep nilfs2'), then your system is vulnerable and requires an update.
Does Defensia detect CVE-2024-26981?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Kernel is installed on a monitored server, CVE-2024-26981 will appear in your dashboard with remediation steps.
Related Kernel CVEs
References
- https://git.kernel.org/stable/c/054f29e9ca05be3906544c5f2a2c7321c30a4243
- https://git.kernel.org/stable/c/2382eae66b196c31893984a538908c3eb7506ff9
- https://git.kernel.org/stable/c/7061c7efbb9e8f11ce92d6b4646405ea2b0b4de1
- https://git.kernel.org/stable/c/897ac5306bbeb83e90c437326f7044c79a17c611
- https://git.kernel.org/stable/c/90823f8d9ecca3d5fa6b102c8e464c62f416975f
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2024-26981. Free for 1 server.
Get started free