Linux Kernel
CVE-2024-26772
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition requires concurrent I/O timing to win, justifying AC:H; all other metrics align with local low-privileged filesystem corruption impact.
Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).
CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Lifecycle Timeline
7DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
Places the logic for checking if the group's block bitmap is corrupt under the protection of the group lock to avoid allocating blocks from the group with a corrupted block bitmap.
AnalysisAI
Ext4 filesystem block allocation in the Linux kernel exposes a race condition in ext4_mb_find_by_goal() where corrupted block group bitmaps can be allocated from because the corruption check runs outside the group lock. Local, low-privileged users on affected systems could trigger filesystem metadata corruption leading to high-severity confidentiality, integrity, and availability impact. No public exploit or CISA KEV listing exists, and the EPSS score of 0.26% (17th percentile) confirms exploitation remains theoretical at this time.
Technical ContextAI
The affected component is the ext4 block allocator in the Linux kernel, specifically the ext4_mb_find_by_goal() function responsible for goal-based block allocation. The ext4 filesystem uses per-group block bitmaps to track free and allocated blocks; each group has an associated lock to serialize concurrent access. The vulnerability arises from a classic TOCTOU (Time of Check, Time of Use) pattern: the check for bitmap corruption was performed without holding the group lock, meaning a concurrent thread could corrupt the bitmap between the check and the subsequent allocation. The fix moves the corruption predicate inside the group lock critical section. Affected CPEs span multiple Linux kernel version ranges (cpe:2.3:o:linux:linux_kernel:*) including release candidates 6.8-rc1 and 6.8-rc2, as well as Debian Linux 10.0 (Buster). No CWE was formally assigned, but the root cause class maps closely to CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization / Race Condition).
RemediationAI
Apply the upstream kernel fix available via the Linux stable tree; eight patch commits are referenced at https://git.kernel.org/stable/c/ (see commit hashes: 21dbe20589c7, 5a6dcc4ad0f7, 6b92b1bc16d6, 832698373a25, 8de8305a25bf, d3bbe77a76bc, d639102f4cbd, ffeb72a80a82). Distribution users should apply vendor-supplied kernel updates - Debian users on 10.0 (Buster) should check the Debian Security Tracker for a patched kernel package. Upstream fix version is not independently confirmed as a tagged release; the fix exists as stable commits. As a compensating control where patching is not immediately possible, limit local user access to systems with ext4 filesystems under high concurrent I/O load, as the race window is most likely to be hit under heavy filesystem activity. Restricting untrusted local user login reduces exploitability in line with the AV:L prerequisite.
More in Debian Linux
View allApache Log4j2 contains a critical JNDI injection vulnerability known as 'Log4Shell' that allows unauthenticated remote c
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allo
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
RARLAB UnRAR before 6.12 on Linux and UNIX allows directory traversal to write to files during an extract (aka unpack) o
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. Rated critical severity (
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today