CVE-2024-26981

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nilfs2: fix OOB in nilfs_set_de_type<br /> <br /> The size of the nilfs_type_by_mode array in the fs/nilfs2/dir.c file is<br /> defined as "S_IFMT &gt;&gt; S_SHIFT", but the nilfs_set_de_type() function,<br /> which uses this array, specifies the index to read from the array in the<br /> same way as "(mode &amp; S_IFMT) &gt;&gt; S_SHIFT".<br /> <br /> static void nilfs_set_de_type(struct nilfs_dir_entry *de, struct inode<br /> *inode)<br /> {<br /> umode_t mode = inode-&gt;i_mode;<br /> <br /> de-&gt;file_type = nilfs_type_by_mode[(mode &amp; S_IFMT)&gt;&gt;S_SHIFT]; // oob<br /> }<br /> <br /> However, when the index is determined this way, an out-of-bounds (OOB)<br /> error occurs by referring to an index that is 1 larger than the array size<br /> when the condition "mode &amp; S_IFMT == S_IFMT" is satisfied. Therefore, a<br /> patch to resize the nilfs_type_by_mode array should be applied to prevent<br /> OOB errors.