CVE-2024-26590
Severity CVSS v4.0:
Pending analysis
Type:
CWE-476
NULL Pointer Dereference
Publication date:
22/02/2024
Last modified:
22/04/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
erofs: fix inconsistent per-file compression format<br />
<br />
EROFS can select compression algorithms on a per-file basis, and each<br />
per-file compression algorithm needs to be marked in the on-disk<br />
superblock for initialization.<br />
<br />
However, syzkaller can generate inconsistent crafted images that use<br />
an unsupported algorithmtype for specific inodes, e.g. use MicroLZMA<br />
algorithmtype even it&#39;s not set in `sbi->available_compr_algs`. This<br />
can lead to an unexpected "BUG: kernel NULL pointer dereference" if<br />
the corresponding decompressor isn&#39;t built-in.<br />
<br />
Fix this by checking against `sbi->available_compr_algs` for each<br />
m_algorithmformat request. Incorrect !erofs_sb_has_compr_cfgs preset<br />
bitmap is now fixed together since it was harmless previously.
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.16.0 (including) | 6.6.14 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 6.7.0 (including) | 6.7.2 (excluding) |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://git.kernel.org/stable/c/118a8cf504d7dfa519562d000f423ee3ca75d2c4
- https://git.kernel.org/stable/c/47467e04816cb297905c0f09bc2d11ef865942d9
- https://git.kernel.org/stable/c/823ba1d2106019ddf195287ba53057aee33cf724
- https://git.kernel.org/stable/c/eed24b816e50c6cd18cbee0ff0d7218c8fced199
- https://git.kernel.org/stable/c/118a8cf504d7dfa519562d000f423ee3ca75d2c4
- https://git.kernel.org/stable/c/47467e04816cb297905c0f09bc2d11ef865942d9
- https://git.kernel.org/stable/c/823ba1d2106019ddf195287ba53057aee33cf724
- https://git.kernel.org/stable/c/eed24b816e50c6cd18cbee0ff0d7218c8fced199



