CVE-2024-39472 xfs: fix log recovery buffer allocation for the legacy h_size fixup

High 7.3 Published 5 Jul 2024 Updated 5 Aug 2026

An out-of-bounds access in the Linux kernel XFS log recovery allows attackers to cause denial of service or potentially execute code via crafted filesystem images.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2024-39472?

CVE-2024-39472 is a high-severity memory corruption vulnerability in Linux kernel, published on 5 Jul 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix log recovery buffer allocation for the legacy h_size fixup

Commit a70f9fe52daa ("xfs: detect and handle invalid iclog size set by mkfs") added a fixup for incorrect h_size values used for the initial umount record in old xfsprogs versions. Later commit 0c771b99d6c9 ("xfs: clean up calculation of LR header blocks") cleaned up the log reover buffer calculation, but stoped using the fixed up h_size value to size the log recovery buffer, which can lead to an out of bounds access when the incorrect h_size does not come from the old mkfs tool, but a fuzzer.

Fix this by open coding xlog_logrec_hblks and taking the fixed h_size into account for this calculation.

Weakness: CWE-770

Which versions are affected by CVE-2024-39472?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2024-39472?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2024-39472 being exploited?

There is no known exploitation of CVE-2024-39472 in the wild and no public exploit code.

All Linux kernel vulnerabilities

Sources

Also known as AZL-43251, AZL-43267, BELL-CVE-2024-39472, DEBIAN-CVE-2024-39472, GHSA-568c-fr2c-8m5p, ROOT-OS-DEBIAN-11-CVE-2024-39472 and 1 more.