CVE-2024-26697: nilfs2: fix data corruption in dsync block recovery for small block sizes
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix data corruption in dsync block recovery for small block sizes
The helper function nilfsrecoverycopyblock() of nilfsrecoverydsyncblocks(), which recovers data from logs created by data sync writes during a mount after an unclean shutdown, incorrectly calculates the on-page offset when copying repair data to the file's page cache. In environments where the block size is smaller than the page size, this flaw can cause data corruption and leak uninitialized memory bytes during the recovery process.
Fix these issues by correcting this byte offset calculation on the page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26697?
CVE-2024-26697 is considered a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2024-26697?
To fix CVE-2024-26697, update your Linux kernel to version 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.10-1, or 6.12.11-1.
What systems are affected by CVE-2024-26697?
CVE-2024-26697 affects Linux systems that utilize the nilfs2 file system.
What kind of issues does CVE-2024-26697 cause?
CVE-2024-26697 can cause data corruption in dsync block recovery for small block sizes.
Is this vulnerability specific to any Linux distributions?
Yes, CVE-2024-26697 primarily affects Debian-based Linux distributions.