GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-49882 (GCVE-0-2024-49882)

Vulnerability from cvelistv5 – Published: 2024-10-21 18:01 – Updated: 2026-08-05 11:40
VLAI
Title
ext4: fix double brelse() the buffer of the extents path
Summary
In the Linux kernel, the following vulnerability has been resolved: ext4: fix double brelse() the buffer of the extents path In ext4_ext_try_to_merge_up(), set path[1].p_bh to NULL after it has been released, otherwise it may be released twice. An example of what triggers this is as follows: split2 map split1 |--------|-------|--------| ext4_ext_map_blocks ext4_ext_handle_unwritten_extents ext4_split_convert_extents // path->p_depth == 0 ext4_split_extent // 1. do split1 ext4_split_extent_at |ext4_ext_insert_extent | ext4_ext_create_new_leaf | ext4_ext_grow_indepth | le16_add_cpu(&neh->eh_depth, 1) | ext4_find_extent | // return -ENOMEM |// get error and try zeroout |path = ext4_find_extent | path->p_depth = 1 |ext4_ext_try_to_merge | ext4_ext_try_to_merge_up | path->p_depth = 0 | brelse(path[1].p_bh) ---> not set to NULL here |// zeroout success // 2. update path ext4_find_extent // 3. do split2 ext4_split_extent_at ext4_ext_insert_extent ext4_ext_create_new_leaf ext4_ext_grow_indepth le16_add_cpu(&neh->eh_depth, 1) ext4_find_extent path[0].p_bh = NULL; path->p_depth = 1 read_extent_tree_block ---> return err // path[1].p_bh is still the old value ext4_free_ext_path ext4_ext_drop_refs // path->p_depth == 1 brelse(path[1].p_bh) ---> brelse a buffer twice Finally got the following WARRNING when removing the buffer from lru: ============================================ VFS: brelse: Trying to free free buffer WARNING: CPU: 2 PID: 72 at fs/buffer.c:1241 __brelse+0x58/0x90 CPU: 2 PID: 72 Comm: kworker/u19:1 Not tainted 6.9.0-dirty #716 RIP: 0010:__brelse+0x58/0x90 Call Trace: <TASK> __find_get_block+0x6e7/0x810 bdev_getblk+0x2b/0x480 __ext4_get_inode_loc+0x48a/0x1240 ext4_get_inode_loc+0xb2/0x150 ext4_reserve_inode_write+0xb7/0x230 __ext4_mark_inode_dirty+0x144/0x6a0 ext4_ext_insert_extent+0x9c8/0x3230 ext4_ext_map_blocks+0xf45/0x2dc0 ext4_map_blocks+0x724/0x1700 ext4_do_writepages+0x12d6/0x2a70 [...] ============================================
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-22 13:45 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ecb94f5fdf4b72547fca022421a9dca1672bddd4 , < d4574bda63906bf69660e001470bfe1a0ac524ae (git)
Affected: ecb94f5fdf4b72547fca022421a9dca1672bddd4 , < f9fd47c9d9548f9e47fa60098eab99dde175401d (git)
Affected: ecb94f5fdf4b72547fca022421a9dca1672bddd4 , < b6c29c8f3d7cb67b505f3b2f6c242d52298d1f2e (git)
Affected: ecb94f5fdf4b72547fca022421a9dca1672bddd4 , < 32bbb59e3f18facd7201bef110010bf35819b8c3 (git)
Affected: ecb94f5fdf4b72547fca022421a9dca1672bddd4 , < 78bbc3d15b6f443acb26e94418c445bac940d414 (git)
Affected: ecb94f5fdf4b72547fca022421a9dca1672bddd4 , < 68a69cf60660c73990c1875f94a5551600b04775 (git)
Affected: ecb94f5fdf4b72547fca022421a9dca1672bddd4 , < 7633407ca4ab8be2916ab214eb44ccebc6a50e1a (git)
Affected: ecb94f5fdf4b72547fca022421a9dca1672bddd4 , < 230ee0535d01478bad9a3037292043f39b9be10b (git)
Affected: ecb94f5fdf4b72547fca022421a9dca1672bddd4 , < dcaa6c31134c0f515600111c38ed7750003e1b9c (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.7
Unaffected: 0 , < 3.7 (semver)
Unaffected: 4.19.323 , ≤ 4.19.* (semver)
Unaffected: 5.4.285 , ≤ 5.4.* (semver)
Unaffected: 5.10.227 , ≤ 5.10.* (semver)
Unaffected: 5.15.168 , ≤ 5.15.* (semver)
Unaffected: 6.1.113 , ≤ 6.1.* (semver)
Unaffected: 6.6.55 , ≤ 6.6.* (semver)
Unaffected: 6.10.14 , ≤ 6.10.* (semver)
Unaffected: 6.11.3 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49882",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:45:30.617937Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:48:50.395Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:22:48.090Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/extents.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d4574bda63906bf69660e001470bfe1a0ac524ae",
              "status": "affected",
              "version": "ecb94f5fdf4b72547fca022421a9dca1672bddd4",
              "versionType": "git"
            },
            {
              "lessThan": "f9fd47c9d9548f9e47fa60098eab99dde175401d",
              "status": "affected",
              "version": "ecb94f5fdf4b72547fca022421a9dca1672bddd4",
              "versionType": "git"
            },
            {
              "lessThan": "b6c29c8f3d7cb67b505f3b2f6c242d52298d1f2e",
              "status": "affected",
              "version": "ecb94f5fdf4b72547fca022421a9dca1672bddd4",
              "versionType": "git"
            },
            {
              "lessThan": "32bbb59e3f18facd7201bef110010bf35819b8c3",
              "status": "affected",
              "version": "ecb94f5fdf4b72547fca022421a9dca1672bddd4",
              "versionType": "git"
            },
            {
              "lessThan": "78bbc3d15b6f443acb26e94418c445bac940d414",
              "status": "affected",
              "version": "ecb94f5fdf4b72547fca022421a9dca1672bddd4",
              "versionType": "git"
            },
            {
              "lessThan": "68a69cf60660c73990c1875f94a5551600b04775",
              "status": "affected",
              "version": "ecb94f5fdf4b72547fca022421a9dca1672bddd4",
              "versionType": "git"
            },
            {
              "lessThan": "7633407ca4ab8be2916ab214eb44ccebc6a50e1a",
              "status": "affected",
              "version": "ecb94f5fdf4b72547fca022421a9dca1672bddd4",
              "versionType": "git"
            },
            {
              "lessThan": "230ee0535d01478bad9a3037292043f39b9be10b",
              "status": "affected",
              "version": "ecb94f5fdf4b72547fca022421a9dca1672bddd4",
              "versionType": "git"
            },
            {
              "lessThan": "dcaa6c31134c0f515600111c38ed7750003e1b9c",
              "status": "affected",
              "version": "ecb94f5fdf4b72547fca022421a9dca1672bddd4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ext4/extents.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.323",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.285",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.323",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.285",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.227",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.55",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.14",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.3",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: fix double brelse() the buffer of the extents path\n\nIn ext4_ext_try_to_merge_up(), set path[1].p_bh to NULL after it has been\nreleased, otherwise it may be released twice. An example of what triggers\nthis is as follows:\n\n  split2    map    split1\n|--------|-------|--------|\n\next4_ext_map_blocks\n ext4_ext_handle_unwritten_extents\n  ext4_split_convert_extents\n   // path-\u003ep_depth == 0\n   ext4_split_extent\n     // 1. do split1\n     ext4_split_extent_at\n       |ext4_ext_insert_extent\n       |  ext4_ext_create_new_leaf\n       |    ext4_ext_grow_indepth\n       |      le16_add_cpu(\u0026neh-\u003eeh_depth, 1)\n       |    ext4_find_extent\n       |      // return -ENOMEM\n       |// get error and try zeroout\n       |path = ext4_find_extent\n       |  path-\u003ep_depth = 1\n       |ext4_ext_try_to_merge\n       |  ext4_ext_try_to_merge_up\n       |    path-\u003ep_depth = 0\n       |    brelse(path[1].p_bh)  ---\u003e not set to NULL here\n       |// zeroout success\n     // 2. update path\n     ext4_find_extent\n     // 3. do split2\n     ext4_split_extent_at\n       ext4_ext_insert_extent\n         ext4_ext_create_new_leaf\n           ext4_ext_grow_indepth\n             le16_add_cpu(\u0026neh-\u003eeh_depth, 1)\n           ext4_find_extent\n             path[0].p_bh = NULL;\n             path-\u003ep_depth = 1\n             read_extent_tree_block  ---\u003e return err\n             // path[1].p_bh is still the old value\n             ext4_free_ext_path\n               ext4_ext_drop_refs\n                 // path-\u003ep_depth == 1\n                 brelse(path[1].p_bh)  ---\u003e brelse a buffer twice\n\nFinally got the following WARRNING when removing the buffer from lru:\n\n============================================\nVFS: brelse: Trying to free free buffer\nWARNING: CPU: 2 PID: 72 at fs/buffer.c:1241 __brelse+0x58/0x90\nCPU: 2 PID: 72 Comm: kworker/u19:1 Not tainted 6.9.0-dirty #716\nRIP: 0010:__brelse+0x58/0x90\nCall Trace:\n \u003cTASK\u003e\n __find_get_block+0x6e7/0x810\n bdev_getblk+0x2b/0x480\n __ext4_get_inode_loc+0x48a/0x1240\n ext4_get_inode_loc+0xb2/0x150\n ext4_reserve_inode_write+0xb7/0x230\n __ext4_mark_inode_dirty+0x144/0x6a0\n ext4_ext_insert_extent+0x9c8/0x3230\n ext4_ext_map_blocks+0xf45/0x2dc0\n ext4_map_blocks+0x724/0x1700\n ext4_do_writepages+0x12d6/0x2a70\n[...]\n============================================"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable extent-split path is reached through ordinary local file operations (fallocate + write/writeback, ZERO_RANGE, punch hole) on a mounted ext4 filesystem, requiring local system access rather than any network protocol handler.\nAC:L - The attacker fully drives both stages \u2014 creating unwritten extents and splitting them at will \u2014 and can force the required allocation/IO failure deterministically via an attacker-controlled backing device (-EIO), a crafted extent block (-EFSCORRUPTED), or self-inflicted GFP_NOFS memory pressure (-ENOMEM), so no condition lies outside the attacker\u0027s influence.\nPR:L - Only an unprivileged local account with write access to any file on an ext4 filesystem (/tmp, /home, an Android app sandbox on /data, a container writable layer) is needed; no capability, root, or namespace escalation is involved.\nUI:N - The attacker performs fallocate() and writes entirely on their own files and can force writeback via fsync(); no victim action such as mounting an image or opening a file is required.\nS:U - The corruption is confined to kernel memory and filesystem metadata within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The stolen buffer_head reference lets a live bh and its folio be freed while still in use, yielding a slab use-after-free whose recycled object contents (b_data, b_page, b_end_io) can be read back, and it can drop a refcount on an unrelated inode\u0027s metadata buffer, exposing arbitrary page-cache contents.\nI:H - The refcount underflow produces a use-after-free on a bh_cachep object containing the b_end_io function pointer and list pointers, giving heap-spray-based write and control-flow-hijack primitives, plus corruption of another inode\u0027s on-disk metadata buffer.\nA:H - The bug reproducibly triggers a WARN in __brelse() (fatal with panic_on_warn) and, in the reference-stealing case, a use-after-free that oopses the kernel and corrupts filesystem metadata, causing a full system crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:40:20.352Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d4574bda63906bf69660e001470bfe1a0ac524ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/f9fd47c9d9548f9e47fa60098eab99dde175401d"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6c29c8f3d7cb67b505f3b2f6c242d52298d1f2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/32bbb59e3f18facd7201bef110010bf35819b8c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/78bbc3d15b6f443acb26e94418c445bac940d414"
        },
        {
          "url": "https://git.kernel.org/stable/c/68a69cf60660c73990c1875f94a5551600b04775"
        },
        {
          "url": "https://git.kernel.org/stable/c/7633407ca4ab8be2916ab214eb44ccebc6a50e1a"
        },
        {
          "url": "https://git.kernel.org/stable/c/230ee0535d01478bad9a3037292043f39b9be10b"
        },
        {
          "url": "https://git.kernel.org/stable/c/dcaa6c31134c0f515600111c38ed7750003e1b9c"
        }
      ],
      "title": "ext4: fix double brelse() the buffer of the extents path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49882",
    "datePublished": "2024-10-21T18:01:20.144Z",
    "dateReserved": "2024-10-21T12:17:06.021Z",
    "dateUpdated": "2026-08-05T11:40:20.352Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-49882",
      "date": "2026-09-15",
      "epss": "0.00319",
      "percentile": "0.24795"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.7\", \"versionEndExcluding\": \"5.10.227\", \"matchCriteriaId\": \"3B73A13A-D7BE-4035-BEF2-2821D9D5CB6D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.168\", \"matchCriteriaId\": \"4D51C05D-455B-4D8D-89E7-A58E140B864C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.113\", \"matchCriteriaId\": \"D01BD22E-ACD1-4618-9D01-6116570BE1EE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.55\", \"matchCriteriaId\": \"E90B9576-56C4-47BC-AAB0-C5B2D438F5D0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.14\", \"matchCriteriaId\": \"4C16BCE0-FFA0-4599-BE0A-1FD65101C021\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.11\", \"versionEndExcluding\": \"6.11.3\", \"matchCriteriaId\": \"54D9C704-D679-41A7-9C40-10A6B1E7FFE9\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\next4: fix double brelse() the buffer of the extents path\\n\\nIn ext4_ext_try_to_merge_up(), set path[1].p_bh to NULL after it has been\\nreleased, otherwise it may be released twice. An example of what triggers\\nthis is as follows:\\n\\n  split2    map    split1\\n|--------|-------|--------|\\n\\next4_ext_map_blocks\\n ext4_ext_handle_unwritten_extents\\n  ext4_split_convert_extents\\n   // path-\u003ep_depth == 0\\n   ext4_split_extent\\n     // 1. do split1\\n     ext4_split_extent_at\\n       |ext4_ext_insert_extent\\n       |  ext4_ext_create_new_leaf\\n       |    ext4_ext_grow_indepth\\n       |      le16_add_cpu(\u0026neh-\u003eeh_depth, 1)\\n       |    ext4_find_extent\\n       |      // return -ENOMEM\\n       |// get error and try zeroout\\n       |path = ext4_find_extent\\n       |  path-\u003ep_depth = 1\\n       |ext4_ext_try_to_merge\\n       |  ext4_ext_try_to_merge_up\\n       |    path-\u003ep_depth = 0\\n       |    brelse(path[1].p_bh)  ---\u003e not set to NULL here\\n       |// zeroout success\\n     // 2. update path\\n     ext4_find_extent\\n     // 3. do split2\\n     ext4_split_extent_at\\n       ext4_ext_insert_extent\\n         ext4_ext_create_new_leaf\\n           ext4_ext_grow_indepth\\n             le16_add_cpu(\u0026neh-\u003eeh_depth, 1)\\n           ext4_find_extent\\n             path[0].p_bh = NULL;\\n             path-\u003ep_depth = 1\\n             read_extent_tree_block  ---\u003e return err\\n             // path[1].p_bh is still the old value\\n             ext4_free_ext_path\\n               ext4_ext_drop_refs\\n                 // path-\u003ep_depth == 1\\n                 brelse(path[1].p_bh)  ---\u003e brelse a buffer twice\\n\\nFinally got the following WARRNING when removing the buffer from lru:\\n\\n============================================\\nVFS: brelse: Trying to free free buffer\\nWARNING: CPU: 2 PID: 72 at fs/buffer.c:1241 __brelse+0x58/0x90\\nCPU: 2 PID: 72 Comm: kworker/u19:1 Not tainted 6.9.0-dirty #716\\nRIP: 0010:__brelse+0x58/0x90\\nCall Trace:\\n \u003cTASK\u003e\\n __find_get_block+0x6e7/0x810\\n bdev_getblk+0x2b/0x480\\n __ext4_get_inode_loc+0x48a/0x1240\\n ext4_get_inode_loc+0xb2/0x150\\n ext4_reserve_inode_write+0xb7/0x230\\n __ext4_mark_inode_dirty+0x144/0x6a0\\n ext4_ext_insert_extent+0x9c8/0x3230\\n ext4_ext_map_blocks+0xf45/0x2dc0\\n ext4_map_blocks+0x724/0x1700\\n ext4_do_writepages+0x12d6/0x2a70\\n[...]\\n============================================\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ext4: corregir el doble brelse() del b\\u00fafer de la ruta de las extensiones En ext4_ext_try_to_merge_up(), establezca path[1].p_bh en NULL despu\\u00e9s de que se haya liberado, de lo contrario, puede liberarse dos veces. Un ejemplo de lo que desencadena esto es el siguiente: split2 map split1 |--------|-------|--------| ext4_ext_map_blocks ext4_ext_handle_unwritten_extents ext4_split_convert_extents // path-\u0026gt;p_depth == 0 ext4_split_extent // 1. hacer split1 ext4_split_extent_at |ext4_ext_insert_extent | ext4_ext_create_new_leaf | ext4_ext_grow_indepth | le16_add_cpu(\u0026amp;neh-\u0026gt;eh_depth, 1) | ext4_find_extent | // devuelve -ENOMEM |// obtiene el error e intenta poner a cero |path = ext4_find_extent | path-\u0026gt;p_depth = 1 |ext4_ext_try_to_merge | ext4_ext_try_to_merge_up | path-\u0026gt;p_depth = 0 | brelse(path[1].p_bh) ---\u0026gt; no establecido en NULL aqu\\u00ed |// puesta a cero exitosa // 2. actualizar ruta ext4_find_extent // 3. hacer split2 ext4_split_extent_at ext4_ext_insert_extent ext4_ext_create_new_leaf ext4_ext_grow_indepth le16_add_cpu(\u0026amp;neh-\u0026gt;eh_depth, 1) ext4_find_extent path[0].p_bh = NULL; path-\u0026gt;p_depth = 1 read_extent_tree_block ---\u0026gt; return err // path[1].p_bh sigue siendo el valor anterior ext4_free_ext_path ext4_ext_drop_refs // path-\u0026gt;p_depth == 1 brelse(path[1].p_bh) ---\u0026gt; brelse un buffer dos veces Finalmente obtuve la siguiente ADVERTENCIA al eliminar el buffer de lru: =============================================== VFS: brelse: Intentando liberar b\\u00fafer libre ADVERTENCIA: CPU: 2 PID: 72 en fs/buffer.c:1241 __brelse+0x58/0x90 CPU: 2 PID: 72 Comm: kworker/u19:1 No contaminado 6.9.0-dirty #716 RIP: 0010:__brelse+0x58/0x90 Seguimiento de llamadas:  __find_get_block+0x6e7/0x810 bdev_getblk+0x2b/0x480 __ext4_get_inode_loc+0x48a/0x1240 ext4_get_inode_loc+0xb2/0x150 ext4_reserve_inode_write+0xb7/0x230 __ext4_mark_inode_dirty+0x144/0x6a0 ext4_ext_insert_extent+0x9c8/0x3230 ext4_ext_map_blocks+0xf45/0x2dc0 ext4_map_blocks+0x724/0x1700 ext4_do_writepages+0x12d6/0x2a70 [...] ============================================\"}]",
      "id": "CVE-2024-49882",
      "lastModified": "2024-11-08T16:15:30.123",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-10-21T18:15:10.790",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/230ee0535d01478bad9a3037292043f39b9be10b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/32bbb59e3f18facd7201bef110010bf35819b8c3\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/68a69cf60660c73990c1875f94a5551600b04775\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/7633407ca4ab8be2916ab214eb44ccebc6a50e1a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/78bbc3d15b6f443acb26e94418c445bac940d414\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b6c29c8f3d7cb67b505f3b2f6c242d52298d1f2e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d4574bda63906bf69660e001470bfe1a0ac524ae\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/dcaa6c31134c0f515600111c38ed7750003e1b9c\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f9fd47c9d9548f9e47fa60098eab99dde175401d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-415\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-21T02:13:29.000Z",
      "cve": "CVE-2024-49882",
      "id": "msrc_CVE-2024-49882",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ext4: fix double brelse() the buffer of the extents path",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-49882.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-49882\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T18:15:10.790\",\"lastModified\":\"2026-08-04T11:20:55.380\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\next4: fix double brelse() the buffer of the extents path\\n\\nIn ext4_ext_try_to_merge_up(), set path[1].p_bh to NULL after it has been\\nreleased, otherwise it may be released twice. An example of what triggers\\nthis is as follows:\\n\\n  split2    map    split1\\n|--------|-------|--------|\\n\\next4_ext_map_blocks\\n ext4_ext_handle_unwritten_extents\\n  ext4_split_convert_extents\\n   // path-\u003ep_depth == 0\\n   ext4_split_extent\\n     // 1. do split1\\n     ext4_split_extent_at\\n       |ext4_ext_insert_extent\\n       |  ext4_ext_create_new_leaf\\n       |    ext4_ext_grow_indepth\\n       |      le16_add_cpu(\u0026neh-\u003eeh_depth, 1)\\n       |    ext4_find_extent\\n       |      // return -ENOMEM\\n       |// get error and try zeroout\\n       |path = ext4_find_extent\\n       |  path-\u003ep_depth = 1\\n       |ext4_ext_try_to_merge\\n       |  ext4_ext_try_to_merge_up\\n       |    path-\u003ep_depth = 0\\n       |    brelse(path[1].p_bh)  ---\u003e not set to NULL here\\n       |// zeroout success\\n     // 2. update path\\n     ext4_find_extent\\n     // 3. do split2\\n     ext4_split_extent_at\\n       ext4_ext_insert_extent\\n         ext4_ext_create_new_leaf\\n           ext4_ext_grow_indepth\\n             le16_add_cpu(\u0026neh-\u003eeh_depth, 1)\\n           ext4_find_extent\\n             path[0].p_bh = NULL;\\n             path-\u003ep_depth = 1\\n             read_extent_tree_block  ---\u003e return err\\n             // path[1].p_bh is still the old value\\n             ext4_free_ext_path\\n               ext4_ext_drop_refs\\n                 // path-\u003ep_depth == 1\\n                 brelse(path[1].p_bh)  ---\u003e brelse a buffer twice\\n\\nFinally got the following WARRNING when removing the buffer from lru:\\n\\n============================================\\nVFS: brelse: Trying to free free buffer\\nWARNING: CPU: 2 PID: 72 at fs/buffer.c:1241 __brelse+0x58/0x90\\nCPU: 2 PID: 72 Comm: kworker/u19:1 Not tainted 6.9.0-dirty #716\\nRIP: 0010:__brelse+0x58/0x90\\nCall Trace:\\n \u003cTASK\u003e\\n __find_get_block+0x6e7/0x810\\n bdev_getblk+0x2b/0x480\\n __ext4_get_inode_loc+0x48a/0x1240\\n ext4_get_inode_loc+0xb2/0x150\\n ext4_reserve_inode_write+0xb7/0x230\\n __ext4_mark_inode_dirty+0x144/0x6a0\\n ext4_ext_insert_extent+0x9c8/0x3230\\n ext4_ext_map_blocks+0xf45/0x2dc0\\n ext4_map_blocks+0x724/0x1700\\n ext4_do_writepages+0x12d6/0x2a70\\n[...]\\n============================================\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ext4: corregir el doble brelse() del b\u00fafer de la ruta de las extensiones En ext4_ext_try_to_merge_up(), establezca path[1].p_bh en NULL despu\u00e9s de que se haya liberado, de lo contrario, puede liberarse dos veces. Un ejemplo de lo que desencadena esto es el siguiente: split2 map split1 |--------|-------|--------| ext4_ext_map_blocks ext4_ext_handle_unwritten_extents ext4_split_convert_extents // path-\u0026gt;p_depth == 0 ext4_split_extent // 1. hacer split1 ext4_split_extent_at |ext4_ext_insert_extent | ext4_ext_create_new_leaf | ext4_ext_grow_indepth | le16_add_cpu(\u0026amp;neh-\u0026gt;eh_depth, 1) | ext4_find_extent | // devuelve -ENOMEM |// obtiene el error e intenta poner a cero |path = ext4_find_extent | path-\u0026gt;p_depth = 1 |ext4_ext_try_to_merge | ext4_ext_try_to_merge_up | path-\u0026gt;p_depth = 0 | brelse(path[1].p_bh) ---\u0026gt; no establecido en NULL aqu\u00ed |// puesta a cero exitosa // 2. actualizar ruta ext4_find_extent // 3. hacer split2 ext4_split_extent_at ext4_ext_insert_extent ext4_ext_create_new_leaf ext4_ext_grow_indepth le16_add_cpu(\u0026amp;neh-\u0026gt;eh_depth, 1) ext4_find_extent path[0].p_bh = NULL; path-\u0026gt;p_depth = 1 read_extent_tree_block ---\u0026gt; return err // path[1].p_bh sigue siendo el valor anterior ext4_free_ext_path ext4_ext_drop_refs // path-\u0026gt;p_depth == 1 brelse(path[1].p_bh) ---\u0026gt; brelse un buffer dos veces Finalmente obtuve la siguiente ADVERTENCIA al eliminar el buffer de lru: =============================================== VFS: brelse: Intentando liberar b\u00fafer libre ADVERTENCIA: CPU: 2 PID: 72 en fs/buffer.c:1241 __brelse+0x58/0x90 CPU: 2 PID: 72 Comm: kworker/u19:1 No contaminado 6.9.0-dirty #716 RIP: 0010:__brelse+0x58/0x90 Seguimiento de llamadas:  __find_get_block+0x6e7/0x810 bdev_getblk+0x2b/0x480 __ext4_get_inode_loc+0x48a/0x1240 ext4_get_inode_loc+0xb2/0x150 ext4_reserve_inode_write+0xb7/0x230 __ext4_mark_inode_dirty+0x144/0x6a0 ext4_ext_insert_extent+0x9c8/0x3230 ext4_ext_map_blocks+0xf45/0x2dc0 ext4_map_blocks+0x724/0x1700 ext4_do_writepages+0x12d6/0x2a70 [...] ============================================\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ext4/extents.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ecb94f5fdf4b72547fca022421a9dca1672bddd4\",\"lessThan\":\"d4574bda63906bf69660e001470bfe1a0ac524ae\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ecb94f5fdf4b72547fca022421a9dca1672bddd4\",\"lessThan\":\"f9fd47c9d9548f9e47fa60098eab99dde175401d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ecb94f5fdf4b72547fca022421a9dca1672bddd4\",\"lessThan\":\"b6c29c8f3d7cb67b505f3b2f6c242d52298d1f2e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ecb94f5fdf4b72547fca022421a9dca1672bddd4\",\"lessThan\":\"32bbb59e3f18facd7201bef110010bf35819b8c3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ecb94f5fdf4b72547fca022421a9dca1672bddd4\",\"lessThan\":\"78bbc3d15b6f443acb26e94418c445bac940d414\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ecb94f5fdf4b72547fca022421a9dca1672bddd4\",\"lessThan\":\"68a69cf60660c73990c1875f94a5551600b04775\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ecb94f5fdf4b72547fca022421a9dca1672bddd4\",\"lessThan\":\"7633407ca4ab8be2916ab214eb44ccebc6a50e1a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ecb94f5fdf4b72547fca022421a9dca1672bddd4\",\"lessThan\":\"230ee0535d01478bad9a3037292043f39b9be10b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ecb94f5fdf4b72547fca022421a9dca1672bddd4\",\"lessThan\":\"dcaa6c31134c0f515600111c38ed7750003e1b9c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ext4/extents.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.323\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.285\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.227\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.168\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.113\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.55\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.14\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.3\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-22T13:45:30.617937Z\",\"id\":\"CVE-2024-49882\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-415\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FA6FEEC2-9F11-4643-8827-749718254FED\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.7\",\"versionEndExcluding\":\"4.19.323\",\"matchCriteriaId\":\"02E209D0-429E-482D-972E-CBF56B5FB05A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.285\",\"matchCriteriaId\":\"B5A89369-320F-47FC-8695-56F61F87E4C0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.227\",\"matchCriteriaId\":\"795A3EE6-0CAB-4409-A903-151C94ACECC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.168\",\"matchCriteriaId\":\"4D51C05D-455B-4D8D-89E7-A58E140B864C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.113\",\"matchCriteriaId\":\"D01BD22E-ACD1-4618-9D01-6116570BE1EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.55\",\"matchCriteriaId\":\"E90B9576-56C4-47BC-AAB0-C5B2D438F5D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.14\",\"matchCriteriaId\":\"4C16BCE0-FFA0-4599-BE0A-1FD65101C021\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.3\",\"matchCriteriaId\":\"54D9C704-D679-41A7-9C40-10A6B1E7FFE9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/230ee0535d01478bad9a3037292043f39b9be10b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/32bbb59e3f18facd7201bef110010bf35819b8c3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/68a69cf60660c73990c1875f94a5551600b04775\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7633407ca4ab8be2916ab214eb44ccebc6a50e1a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/78bbc3d15b6f443acb26e94418c445bac940d414\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b6c29c8f3d7cb67b505f3b2f6c242d52298d1f2e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d4574bda63906bf69660e001470bfe1a0ac524ae\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dcaa6c31134c0f515600111c38ed7750003e1b9c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f9fd47c9d9548f9e47fa60098eab99dde175401d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T15:08:01+00:00",
      "cve": "CVE-2024-49882",
      "id": "CVE-2024-49882",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:fixed": "305",
      "product_status:known_affected": "112",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ext4: fix double brelse() the buffer of the extents path",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-49882.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T02:21:11Z",
      "cve": "CVE-2024-49882",
      "id": "CVE-2024-49882",
      "initial_release_date": "2024-10-24T03:19:01Z",
      "product_status:known_affected": "649",
      "product_status:known_not_affected": "38",
      "product_status:recommended": "721",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-49882",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-49882.json",
      "version": "75"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:22:48.090Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49882\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:45:30.617937Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:45:33.703Z\"}}], \"cna\": {\"title\": \"ext4: fix double brelse() the buffer of the extents path\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"ecb94f5fdf4b72547fca022421a9dca1672bddd4\", \"lessThan\": \"d4574bda63906bf69660e001470bfe1a0ac524ae\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ecb94f5fdf4b72547fca022421a9dca1672bddd4\", \"lessThan\": \"f9fd47c9d9548f9e47fa60098eab99dde175401d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ecb94f5fdf4b72547fca022421a9dca1672bddd4\", \"lessThan\": \"b6c29c8f3d7cb67b505f3b2f6c242d52298d1f2e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ecb94f5fdf4b72547fca022421a9dca1672bddd4\", \"lessThan\": \"32bbb59e3f18facd7201bef110010bf35819b8c3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ecb94f5fdf4b72547fca022421a9dca1672bddd4\", \"lessThan\": \"78bbc3d15b6f443acb26e94418c445bac940d414\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ecb94f5fdf4b72547fca022421a9dca1672bddd4\", \"lessThan\": \"68a69cf60660c73990c1875f94a5551600b04775\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ecb94f5fdf4b72547fca022421a9dca1672bddd4\", \"lessThan\": \"7633407ca4ab8be2916ab214eb44ccebc6a50e1a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ecb94f5fdf4b72547fca022421a9dca1672bddd4\", \"lessThan\": \"230ee0535d01478bad9a3037292043f39b9be10b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ecb94f5fdf4b72547fca022421a9dca1672bddd4\", \"lessThan\": \"dcaa6c31134c0f515600111c38ed7750003e1b9c\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/ext4/extents.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"4.19.323\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.19.*\"}, {\"status\": \"unaffected\", \"version\": \"5.4.285\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.227\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.55\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/ext4/extents.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d4574bda63906bf69660e001470bfe1a0ac524ae\"}, {\"url\": \"https://git.kernel.org/stable/c/f9fd47c9d9548f9e47fa60098eab99dde175401d\"}, {\"url\": \"https://git.kernel.org/stable/c/b6c29c8f3d7cb67b505f3b2f6c242d52298d1f2e\"}, {\"url\": \"https://git.kernel.org/stable/c/32bbb59e3f18facd7201bef110010bf35819b8c3\"}, {\"url\": \"https://git.kernel.org/stable/c/78bbc3d15b6f443acb26e94418c445bac940d414\"}, {\"url\": \"https://git.kernel.org/stable/c/68a69cf60660c73990c1875f94a5551600b04775\"}, {\"url\": \"https://git.kernel.org/stable/c/7633407ca4ab8be2916ab214eb44ccebc6a50e1a\"}, {\"url\": \"https://git.kernel.org/stable/c/230ee0535d01478bad9a3037292043f39b9be10b\"}, {\"url\": \"https://git.kernel.org/stable/c/dcaa6c31134c0f515600111c38ed7750003e1b9c\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\next4: fix double brelse() the buffer of the extents path\\n\\nIn ext4_ext_try_to_merge_up(), set path[1].p_bh to NULL after it has been\\nreleased, otherwise it may be released twice. An example of what triggers\\nthis is as follows:\\n\\n  split2    map    split1\\n|--------|-------|--------|\\n\\next4_ext_map_blocks\\n ext4_ext_handle_unwritten_extents\\n  ext4_split_convert_extents\\n   // path-\u003ep_depth == 0\\n   ext4_split_extent\\n     // 1. do split1\\n     ext4_split_extent_at\\n       |ext4_ext_insert_extent\\n       |  ext4_ext_create_new_leaf\\n       |    ext4_ext_grow_indepth\\n       |      le16_add_cpu(\u0026neh-\u003eeh_depth, 1)\\n       |    ext4_find_extent\\n       |      // return -ENOMEM\\n       |// get error and try zeroout\\n       |path = ext4_find_extent\\n       |  path-\u003ep_depth = 1\\n       |ext4_ext_try_to_merge\\n       |  ext4_ext_try_to_merge_up\\n       |    path-\u003ep_depth = 0\\n       |    brelse(path[1].p_bh)  ---\u003e not set to NULL here\\n       |// zeroout success\\n     // 2. update path\\n     ext4_find_extent\\n     // 3. do split2\\n     ext4_split_extent_at\\n       ext4_ext_insert_extent\\n         ext4_ext_create_new_leaf\\n           ext4_ext_grow_indepth\\n             le16_add_cpu(\u0026neh-\u003eeh_depth, 1)\\n           ext4_find_extent\\n             path[0].p_bh = NULL;\\n             path-\u003ep_depth = 1\\n             read_extent_tree_block  ---\u003e return err\\n             // path[1].p_bh is still the old value\\n             ext4_free_ext_path\\n               ext4_ext_drop_refs\\n                 // path-\u003ep_depth == 1\\n                 brelse(path[1].p_bh)  ---\u003e brelse a buffer twice\\n\\nFinally got the following WARRNING when removing the buffer from lru:\\n\\n============================================\\nVFS: brelse: Trying to free free buffer\\nWARNING: CPU: 2 PID: 72 at fs/buffer.c:1241 __brelse+0x58/0x90\\nCPU: 2 PID: 72 Comm: kworker/u19:1 Not tainted 6.9.0-dirty #716\\nRIP: 0010:__brelse+0x58/0x90\\nCall Trace:\\n \u003cTASK\u003e\\n __find_get_block+0x6e7/0x810\\n bdev_getblk+0x2b/0x480\\n __ext4_get_inode_loc+0x48a/0x1240\\n ext4_get_inode_loc+0xb2/0x150\\n ext4_reserve_inode_write+0xb7/0x230\\n __ext4_mark_inode_dirty+0x144/0x6a0\\n ext4_ext_insert_extent+0x9c8/0x3230\\n ext4_ext_map_blocks+0xf45/0x2dc0\\n ext4_map_blocks+0x724/0x1700\\n ext4_do_writepages+0x12d6/0x2a70\\n[...]\\n============================================\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"4.19.323\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.285\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.227\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.168\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.113\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.55\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.14\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.3\", \"versionStartIncluding\": \"3.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"3.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:40:17.799Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49882\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-03T22:22:48.090Z\", \"dateReserved\": \"2024-10-21T12:17:06.021Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T18:01:20.144Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.