CVE-2024-47669 nilfs2: fix state management in error path of log writing function

What is CVE-2024-47669?

CVE-2024-47669 is a high-severity denial of service vulnerability in Linux kernel, published on 9 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix state management in error path of log writing function

After commit a694291a6211 ("nilfs2: separate wait function from nilfs_segctor_write") was applied, the log writing function nilfs_segctor_do_construct() was able to issue I/O requests continuously even if user data blocks were split into multiple logs across segments, but two potential flaws were introduced in its error handling.

First, if nilfs_segctor_begin_construction() fails while creating the second or subsequent logs, the log writing function returns without calling nilfs_segctor_abort_construction(), so the writeback flag set on pages/folios will remain uncleared. This causes page cache operations to hang waiting for the writeback flag. For example, truncate_inode_pages_final(), which is called via nilfs_evict_inode() when an inode is evicted from memory, will hang.

Second, the NILFS_I_COLLECTED flag set on normal inodes remain uncleared. As a result, if the next log write involves checkpoint creation, that's fine, but if a partial log write is performed that does not, inodes with NILFS_I_COLLECTED set are erroneously removed from the "sc_dirty_files" list, and their data and b-tree blocks may not be written to the device, corrupting the block mapping.

Fix these issues by uniformly calling nilfs_segctor_abort_construction() on failure of each step in the loop in nilfs_segctor_do_construct(), having it clean up logs and segment usages according to progress, and correcting the conditions for calling nilfs_redirty_inodes() to ensure that the NILFS_I_COLLECTED flag is cleared.

Which versions are affected by CVE-2024-47669?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2024-47669?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-47669 being exploited?

There is no known exploitation of CVE-2024-47669 in the wild and no public exploit code.

Other vulnerabilities in Linux kernel

• CVE-2026-53266 Linux Kernel Out-of-Bounds Write Exploited High 8.8
• CVE-2013-6282 Linux Kernel Improper Input Validation Exploited High 8.8
• CVE-2022-0185 Linux Kernel Heap-Based Buffer Overflow Exploited High 8.4
• CVE-2013-2094 Linux Kernel Privilege Escalation Exploited High 8.4
• CVE-2026-53362 Linux Kernel Unspecified Exploited High 7.8

All Linux kernel vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BELL-CVE-2024-47669, DEBIAN-CVE-2024-47669, GHSA-g9rj-gvxx-c5jc, ROOT-OS-DEBIAN-11-CVE-2024-47669, UBUNTU-CVE-2024-47669.