CVE-2024-47726
f2fs: fix to wait dio completion
HIGH 7.8
At a glance
- Source
- NVD
- EPSS
- EPSS 0.65 % · percentile 51 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to wait dio completion It should wait all existing dio write IOs before block removal, otherwise, previous direct write IO may overwrite data in the block which may be reused by other inode.
References
- https://git.kernel.org/stable/c/7be13b73409b553d9d9a6cbb042b4d19e2631cc7
- https://git.kernel.org/stable/c/3aa5254d80969cb576601fb9fec7a188cc8dc169
- https://git.kernel.org/stable/c/f81302decd64245bb1bd154ecae0f65a9ee21f04
- https://git.kernel.org/stable/c/c2a7fc514637f640ff55c3f3e3ed879970814a3f
- https://git.kernel.org/stable/c/e3db757ff9b7101ae68650ac5f6dd5743b68164e
- https://git.kernel.org/stable/c/96cfeb0389530ae32ade8a48ae3ae1ac3b6c009d
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-42642
- GCVE · GCVE-0-2024-47726
CERT-FR advisories
- CERTFR-2025-AVI-0559 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0463 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0366 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0349 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0277 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0276 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0185 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0152 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*< 6.11.2
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < 7be13b73409b553d9d9a6cbb042b4d19e2631cc7 ; affected 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < 3aa5254d80969cb576601fb9fec7a188cc8dc169 ; affected 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < f81302decd64245bb1bd154ecae0f65a9ee21f04 ; affected 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < c2a7fc514637f640ff55c3f3e3ed879970814a3f ; affected 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < e3db757ff9b7101ae68650ac5f6dd5743b68164e ; affected 98e4da8ca301e062d79ae168c67e56f3c3de3ce4 < 96cfeb0389530ae32ade8a48ae3ae1ac3b6c009d |
| Linux · Linux | affected 3.8 ; unaffected 0 < 3.8 ; unaffected 5.10.235 ≤ 5.10.* ; unaffected 5.15.179 ≤ 5.15.* ; unaffected 6.1.129 ≤ 6.1.* ; unaffected 6.6.70 ≤ 6.6.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |