CVE-2024-38626 (GCVE-0-2024-38626)

Vulnerability from cvelistv5 – Published: 2024-06-21 10:18 – Updated: 2026-08-05 11:33
VLAI
Title
fuse: clear FR_SENT when re-adding requests into pending list
Summary
In the Linux kernel, the following vulnerability has been resolved: fuse: clear FR_SENT when re-adding requests into pending list The following warning was reported by lee bruce: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 8264 at fs/fuse/dev.c:300 fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300 Modules linked in: CPU: 0 PID: 8264 Comm: ab2 Not tainted 6.9.0-rc7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300 ...... Call Trace: <TASK> fuse_dev_do_read.constprop.0+0xd36/0x1dd0 fs/fuse/dev.c:1334 fuse_dev_read+0x166/0x200 fs/fuse/dev.c:1367 call_read_iter include/linux/fs.h:2104 [inline] new_sync_read fs/read_write.c:395 [inline] vfs_read+0x85b/0xba0 fs/read_write.c:476 ksys_read+0x12f/0x260 fs/read_write.c:619 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xce/0x260 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f ...... </TASK> The warning is due to the FUSE_NOTIFY_RESEND notify sent by the write() syscall in the reproducer program and it happens as follows: (1) calls fuse_dev_read() to read the INIT request The read succeeds. During the read, bit FR_SENT will be set on the request. (2) calls fuse_dev_write() to send an USE_NOTIFY_RESEND notify The resend notify will resend all processing requests, so the INIT request is moved from processing list to pending list again. (3) calls fuse_dev_read() with an invalid output address fuse_dev_read() will try to copy the same INIT request to the output address, but it will fail due to the invalid address, so the INIT request is ended and triggers the warning in fuse_request_end(). Fix it by clearing FR_SENT when re-adding requests into pending list.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 760eac73f9f69aa28fcb3050b4946c2dcc656d12 , < 533070db659a9589310a743e9de14cf9d651ffaf (git)
Affected: 760eac73f9f69aa28fcb3050b4946c2dcc656d12 , < 246014876d782bbf2e652267482cd2e799fb5fcd (git)
Create a notification for this product.
Linux Linux Affected: 6.9
Unaffected: 0 , < 6.9 (semver)
Unaffected: 6.9.4 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:26.061Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/533070db659a9589310a743e9de14cf9d651ffaf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/246014876d782bbf2e652267482cd2e799fb5fcd"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-38626",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:09:09.210005Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:44.692Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "533070db659a9589310a743e9de14cf9d651ffaf",
              "status": "affected",
              "version": "760eac73f9f69aa28fcb3050b4946c2dcc656d12",
              "versionType": "git"
            },
            {
              "lessThan": "246014876d782bbf2e652267482cd2e799fb5fcd",
              "status": "affected",
              "version": "760eac73f9f69aa28fcb3050b4946c2dcc656d12",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/fuse/dev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.9"
            },
            {
              "lessThan": "6.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.4",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: clear FR_SENT when re-adding requests into pending list\n\nThe following warning was reported by lee bruce:\n\n  ------------[ cut here ]------------\n  WARNING: CPU: 0 PID: 8264 at fs/fuse/dev.c:300\n  fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300\n  Modules linked in:\n  CPU: 0 PID: 8264 Comm: ab2 Not tainted 6.9.0-rc7\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\n  RIP: 0010:fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300\n  ......\n  Call Trace:\n  \u003cTASK\u003e\n  fuse_dev_do_read.constprop.0+0xd36/0x1dd0 fs/fuse/dev.c:1334\n  fuse_dev_read+0x166/0x200 fs/fuse/dev.c:1367\n  call_read_iter include/linux/fs.h:2104 [inline]\n  new_sync_read fs/read_write.c:395 [inline]\n  vfs_read+0x85b/0xba0 fs/read_write.c:476\n  ksys_read+0x12f/0x260 fs/read_write.c:619\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xce/0x260 arch/x86/entry/common.c:83\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  ......\n  \u003c/TASK\u003e\n\nThe warning is due to the FUSE_NOTIFY_RESEND notify sent by the write()\nsyscall in the reproducer program and it happens as follows:\n\n(1) calls fuse_dev_read() to read the INIT request\nThe read succeeds. During the read, bit FR_SENT will be set on the\nrequest.\n(2) calls fuse_dev_write() to send an USE_NOTIFY_RESEND notify\nThe resend notify will resend all processing requests, so the INIT\nrequest is moved from processing list to pending list again.\n(3) calls fuse_dev_read() with an invalid output address\nfuse_dev_read() will try to copy the same INIT request to the output\naddress, but it will fail due to the invalid address, so the INIT\nrequest is ended and triggers the warning in fuse_request_end().\n\nFix it by clearing FR_SENT when re-adding requests into pending list."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local syscalls only \u2014 opening /dev/fuse, mounting a FUSE filesystem, and issuing read()/write() on the device fd to deliver FUSE_NOTIFY_RESEND. There is no network-facing path into fuse_resend().\nAC:L - The trigger is a deterministic syscall sequence (read request \u2192 write FUSE_NOTIFY_RESEND \u2192 read into a faulting buffer, or signal the waiter), all driven from the attacker\u0027s own process with no race or memory-layout condition outside their control.\nPR:L - An unprivileged local user suffices: fuse is registered with FS_USERNS_MOUNT so the filesystem can be mounted inside `unshare -Urm`, and /dev/fuse is world-accessible on stock distributions (with setuid fusermount3 as an alternative). No real root or init-namespace capability is needed.\nUI:N - The attacking process acts as both the FUSE daemon and the requester thread, performing every step itself. No victim action is required.\nS:U - The corruption is confined to kernel FUSE request objects and queues within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Losing the FR_SENT/FR_PENDING invariant lets a fuse_req be freed while still linked on fiq-\u003einterrupts, and the subsequent read of that dangling entry exposes reallocated slab contents to the attacker-controlled daemon; the WARN splat additionally dumps kernel addresses and register state.\nI:H - The use-after-free on the fiq-\u003einterrupts list yields a list-unlink write into memory the attacker can groom by reclaiming the freed fuse_req slab object, a standard route to arbitrary write and control-flow hijack.\nA:H - The documented outcome is a WARNING at fs/fuse/dev.c:300, which panics the machine when panic_on_warn is set, and the underlying use-after-free/list corruption causes oopses; an unprivileged user can trigger it repeatedly at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:33:15.652Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/533070db659a9589310a743e9de14cf9d651ffaf"
        },
        {
          "url": "https://git.kernel.org/stable/c/246014876d782bbf2e652267482cd2e799fb5fcd"
        }
      ],
      "title": "fuse: clear FR_SENT when re-adding requests into pending list",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-38626",
    "datePublished": "2024-06-21T10:18:18.255Z",
    "dateReserved": "2024-06-18T19:36:34.945Z",
    "dateUpdated": "2026-08-05T11:33:15.652Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-38626",
      "date": "2026-08-09",
      "epss": "0.00201",
      "percentile": "0.10105"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfuse: clear FR_SENT when re-adding requests into pending list\\n\\nThe following warning was reported by lee bruce:\\n\\n  ------------[ cut here ]------------\\n  WARNING: CPU: 0 PID: 8264 at fs/fuse/dev.c:300\\n  fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300\\n  Modules linked in:\\n  CPU: 0 PID: 8264 Comm: ab2 Not tainted 6.9.0-rc7\\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\\n  RIP: 0010:fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300\\n  ......\\n  Call Trace:\\n  \u003cTASK\u003e\\n  fuse_dev_do_read.constprop.0+0xd36/0x1dd0 fs/fuse/dev.c:1334\\n  fuse_dev_read+0x166/0x200 fs/fuse/dev.c:1367\\n  call_read_iter include/linux/fs.h:2104 [inline]\\n  new_sync_read fs/read_write.c:395 [inline]\\n  vfs_read+0x85b/0xba0 fs/read_write.c:476\\n  ksys_read+0x12f/0x260 fs/read_write.c:619\\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n  do_syscall_64+0xce/0x260 arch/x86/entry/common.c:83\\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n  ......\\n  \u003c/TASK\u003e\\n\\nThe warning is due to the FUSE_NOTIFY_RESEND notify sent by the write()\\nsyscall in the reproducer program and it happens as follows:\\n\\n(1) calls fuse_dev_read() to read the INIT request\\nThe read succeeds. During the read, bit FR_SENT will be set on the\\nrequest.\\n(2) calls fuse_dev_write() to send an USE_NOTIFY_RESEND notify\\nThe resend notify will resend all processing requests, so the INIT\\nrequest is moved from processing list to pending list again.\\n(3) calls fuse_dev_read() with an invalid output address\\nfuse_dev_read() will try to copy the same INIT request to the output\\naddress, but it will fail due to the invalid address, so the INIT\\nrequest is ended and triggers the warning in fuse_request_end().\\n\\nFix it by clearing FR_SENT when re-adding requests into pending list.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: fusible: borre FR_SENT al volver a agregar solicitudes a la lista pendiente Lee bruce inform\\u00f3 la siguiente advertencia: ------------[ cortar aqu\\u00ed ]- ----------- ADVERTENCIA: CPU: 0 PID: 8264 en fs/fuse/dev.c:300 fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300 M\\u00f3dulos vinculados en: CPU: 0 PID: 8264 Comm: ab2 No contaminado 6.9.0-rc7 Nombre del hardware: PC est\\u00e1ndar QEMU (i440FX + PIIX, 1996) RIP: 0010:fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300 ...... Seguimiento de llamadas:  fuse_dev_do_read.constprop.0+0xd36/0x1dd0 fs/fuse/dev.c:1334 fuse_dev_read+0x166/0x200 fs/fuse/dev.c:1367 call_read_iter include/linux/fs.h:2104 [en l\\u00ednea ] new_sync_read fs/read_write.c:395 [en l\\u00ednea] vfs_read+0x85b/0xba0 fs/read_write.c:476 ksys_read+0x12f/0x260 fs/read_write.c:619 do_syscall_x64 arch/x86/entry/common.c:52 [en l\\u00ednea ] do_syscall_64+0xce/0x260 arch/x86/entry/common.c:83 Entry_SYSCALL_64_after_hwframe+0x77/0x7f ......  La advertencia se debe a la notificaci\\u00f3n FUSE_NOTIFY_RESEND enviada por la llamada al sistema write() en el reproductor programa y sucede de la siguiente manera: (1) llama a fuse_dev_read() para leer la solicitud INIT La lectura se realiza correctamente. Durante la lectura, se establecer\\u00e1 el bit FR_SENT en la solicitud. (2) llama a fuse_dev_write() para enviar una notificaci\\u00f3n USE_NOTIFY_RESEND. La notificaci\\u00f3n de reenv\\u00edo reenviar\\u00e1 todas las solicitudes de procesamiento, por lo que la solicitud INIT se mueve nuevamente de la lista de procesamiento a la lista pendiente. (3) llama a fuse_dev_read() con una direcci\\u00f3n de salida no v\\u00e1lida. fuse_dev_read() intentar\\u00e1 copiar la misma solicitud INIT a la direcci\\u00f3n de salida, pero fallar\\u00e1 debido a la direcci\\u00f3n no v\\u00e1lida, por lo que la solicitud INIT finaliza y activa la advertencia en fuse_request_end (). Solucionelo borrando FR_SENT al volver a agregar solicitudes a la lista pendiente.\"}]",
      "id": "CVE-2024-38626",
      "lastModified": "2024-11-21T09:26:31.267",
      "published": "2024-06-21T11:15:11.517",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/246014876d782bbf2e652267482cd2e799fb5fcd\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/533070db659a9589310a743e9de14cf9d651ffaf\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/246014876d782bbf2e652267482cd2e799fb5fcd\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/533070db659a9589310a743e9de14cf9d651ffaf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-38626\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-21T11:15:11.517\",\"lastModified\":\"2026-08-04T11:18:53.630\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfuse: clear FR_SENT when re-adding requests into pending list\\n\\nThe following warning was reported by lee bruce:\\n\\n  ------------[ cut here ]------------\\n  WARNING: CPU: 0 PID: 8264 at fs/fuse/dev.c:300\\n  fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300\\n  Modules linked in:\\n  CPU: 0 PID: 8264 Comm: ab2 Not tainted 6.9.0-rc7\\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\\n  RIP: 0010:fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300\\n  ......\\n  Call Trace:\\n  \u003cTASK\u003e\\n  fuse_dev_do_read.constprop.0+0xd36/0x1dd0 fs/fuse/dev.c:1334\\n  fuse_dev_read+0x166/0x200 fs/fuse/dev.c:1367\\n  call_read_iter include/linux/fs.h:2104 [inline]\\n  new_sync_read fs/read_write.c:395 [inline]\\n  vfs_read+0x85b/0xba0 fs/read_write.c:476\\n  ksys_read+0x12f/0x260 fs/read_write.c:619\\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n  do_syscall_64+0xce/0x260 arch/x86/entry/common.c:83\\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n  ......\\n  \u003c/TASK\u003e\\n\\nThe warning is due to the FUSE_NOTIFY_RESEND notify sent by the write()\\nsyscall in the reproducer program and it happens as follows:\\n\\n(1) calls fuse_dev_read() to read the INIT request\\nThe read succeeds. During the read, bit FR_SENT will be set on the\\nrequest.\\n(2) calls fuse_dev_write() to send an USE_NOTIFY_RESEND notify\\nThe resend notify will resend all processing requests, so the INIT\\nrequest is moved from processing list to pending list again.\\n(3) calls fuse_dev_read() with an invalid output address\\nfuse_dev_read() will try to copy the same INIT request to the output\\naddress, but it will fail due to the invalid address, so the INIT\\nrequest is ended and triggers the warning in fuse_request_end().\\n\\nFix it by clearing FR_SENT when re-adding requests into pending list.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: fusible: borre FR_SENT al volver a agregar solicitudes a la lista pendiente Lee bruce inform\u00f3 la siguiente advertencia: ------------[ cortar aqu\u00ed ]- ----------- ADVERTENCIA: CPU: 0 PID: 8264 en fs/fuse/dev.c:300 fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300 M\u00f3dulos vinculados en: CPU: 0 PID: 8264 Comm: ab2 No contaminado 6.9.0-rc7 Nombre del hardware: PC est\u00e1ndar QEMU (i440FX + PIIX, 1996) RIP: 0010:fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300 ...... Seguimiento de llamadas:  fuse_dev_do_read.constprop.0+0xd36/0x1dd0 fs/fuse/dev.c:1334 fuse_dev_read+0x166/0x200 fs/fuse/dev.c:1367 call_read_iter include/linux/fs.h:2104 [en l\u00ednea ] new_sync_read fs/read_write.c:395 [en l\u00ednea] vfs_read+0x85b/0xba0 fs/read_write.c:476 ksys_read+0x12f/0x260 fs/read_write.c:619 do_syscall_x64 arch/x86/entry/common.c:52 [en l\u00ednea ] do_syscall_64+0xce/0x260 arch/x86/entry/common.c:83 Entry_SYSCALL_64_after_hwframe+0x77/0x7f ......  La advertencia se debe a la notificaci\u00f3n FUSE_NOTIFY_RESEND enviada por la llamada al sistema write() en el reproductor programa y sucede de la siguiente manera: (1) llama a fuse_dev_read() para leer la solicitud INIT La lectura se realiza correctamente. Durante la lectura, se establecer\u00e1 el bit FR_SENT en la solicitud. (2) llama a fuse_dev_write() para enviar una notificaci\u00f3n USE_NOTIFY_RESEND. La notificaci\u00f3n de reenv\u00edo reenviar\u00e1 todas las solicitudes de procesamiento, por lo que la solicitud INIT se mueve nuevamente de la lista de procesamiento a la lista pendiente. (3) llama a fuse_dev_read() con una direcci\u00f3n de salida no v\u00e1lida. fuse_dev_read() intentar\u00e1 copiar la misma solicitud INIT a la direcci\u00f3n de salida, pero fallar\u00e1 debido a la direcci\u00f3n no v\u00e1lida, por lo que la solicitud INIT finaliza y activa la advertencia en fuse_request_end (). Solucionelo borrando FR_SENT al volver a agregar solicitudes a la lista pendiente.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/fuse/dev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"760eac73f9f69aa28fcb3050b4946c2dcc656d12\",\"lessThan\":\"533070db659a9589310a743e9de14cf9d651ffaf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"760eac73f9f69aa28fcb3050b4946c2dcc656d12\",\"lessThan\":\"246014876d782bbf2e652267482cd2e799fb5fcd\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/fuse/dev.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.9\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.9\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9.4\",\"lessThanOrEqual\":\"6.9.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T17:09:09.210005Z\",\"id\":\"CVE-2024-38626\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.9.4\",\"matchCriteriaId\":\"A500F935-F0ED-4DC7-AD02-9D7C365D13AE\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/246014876d782bbf2e652267482cd2e799fb5fcd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/533070db659a9589310a743e9de14cf9d651ffaf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/246014876d782bbf2e652267482cd2e799fb5fcd\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/533070db659a9589310a743e9de14cf9d651ffaf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:44:57+00:00",
      "cve": "CVE-2024-38626",
      "id": "CVE-2024-38626",
      "initial_release_date": "2024-06-21T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fuse: clear FR_SENT when re-adding requests into pending list",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-38626.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-23T02:04:30Z",
      "cve": "CVE-2024-38626",
      "id": "CVE-2024-38626",
      "initial_release_date": "2024-06-24T23:15:27Z",
      "product_status:known_not_affected": "318",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-38626",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-38626.json",
      "version": "17"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/533070db659a9589310a743e9de14cf9d651ffaf\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/246014876d782bbf2e652267482cd2e799fb5fcd\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:12:26.061Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-38626\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:09:09.210005Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:25.534Z\"}}], \"cna\": {\"title\": \"fuse: clear FR_SENT when re-adding requests into pending list\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"760eac73f9f69aa28fcb3050b4946c2dcc656d12\", \"lessThan\": \"533070db659a9589310a743e9de14cf9d651ffaf\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"760eac73f9f69aa28fcb3050b4946c2dcc656d12\", \"lessThan\": \"246014876d782bbf2e652267482cd2e799fb5fcd\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/fuse/dev.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.9.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/fuse/dev.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/533070db659a9589310a743e9de14cf9d651ffaf\"}, {\"url\": \"https://git.kernel.org/stable/c/246014876d782bbf2e652267482cd2e799fb5fcd\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfuse: clear FR_SENT when re-adding requests into pending list\\n\\nThe following warning was reported by lee bruce:\\n\\n  ------------[ cut here ]------------\\n  WARNING: CPU: 0 PID: 8264 at fs/fuse/dev.c:300\\n  fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300\\n  Modules linked in:\\n  CPU: 0 PID: 8264 Comm: ab2 Not tainted 6.9.0-rc7\\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\\n  RIP: 0010:fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300\\n  ......\\n  Call Trace:\\n  \u003cTASK\u003e\\n  fuse_dev_do_read.constprop.0+0xd36/0x1dd0 fs/fuse/dev.c:1334\\n  fuse_dev_read+0x166/0x200 fs/fuse/dev.c:1367\\n  call_read_iter include/linux/fs.h:2104 [inline]\\n  new_sync_read fs/read_write.c:395 [inline]\\n  vfs_read+0x85b/0xba0 fs/read_write.c:476\\n  ksys_read+0x12f/0x260 fs/read_write.c:619\\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n  do_syscall_64+0xce/0x260 arch/x86/entry/common.c:83\\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n  ......\\n  \u003c/TASK\u003e\\n\\nThe warning is due to the FUSE_NOTIFY_RESEND notify sent by the write()\\nsyscall in the reproducer program and it happens as follows:\\n\\n(1) calls fuse_dev_read() to read the INIT request\\nThe read succeeds. During the read, bit FR_SENT will be set on the\\nrequest.\\n(2) calls fuse_dev_write() to send an USE_NOTIFY_RESEND notify\\nThe resend notify will resend all processing requests, so the INIT\\nrequest is moved from processing list to pending list again.\\n(3) calls fuse_dev_read() with an invalid output address\\nfuse_dev_read() will try to copy the same INIT request to the output\\naddress, but it will fail due to the invalid address, so the INIT\\nrequest is ended and triggers the warning in fuse_request_end().\\n\\nFix it by clearing FR_SENT when re-adding requests into pending list.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-19T09:05:55.923Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-38626\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-19T09:05:55.923Z\", \"dateReserved\": \"2024-06-18T19:36:34.945Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-21T10:18:18.255Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.