{"id":"CVE-2024-49889","revision":"8c70fc003dd247cf9f3aa66ef5434231","records":[{"revision":"8c70fc003dd247cf9f3aa66ef5434231","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-49889","aliases":[],"title":"ext4: avoid use-after-free in ext4_ext_show_leaf()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\next4: avoid use-after-free in ext4_ext_show_leaf()\n\nIn ext4_find_extent(), path may be freed by error or be reallocated, so\nusing a previously saved *ppath may have been freed and thus may trigger\nuse-after-free, as follows:\n\next4_split_extent\n  path = *ppath;\n  ext4_split_extent_at(ppath)\n  path = ext4_find_extent(ppath)\n  ext4_split_extent_at(ppath)\n    // ext4_find_extent fails to free path\n    // but zeroout succeeds\n  ext4_ext_show_leaf(inode, path)\n    eh = path[depth].p_hdr\n    // path use-after-free !!!\n\nSimilar to ext4_split_extent_at(), we use *ppath directly as an input to\next4_ext_show_leaf(). Fix a spelling error by the way.\n\nSame problem in ext4_ext_handle_unwritten_extents(). Since 'path' is only\nused in ext4_ext_show_leaf(), remove 'path' and use *ppath directly.\n\nThis issue is triggered only when EXT_DEBUG is defined and therefore does\nnot affect functionality.","state":0,"publishedAt":"2024-10-21T18:01:24.941+00:00","modifiedAt":"2026-10-15T00:53:41.346+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/ext4/extents.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"dfe5080939ea4686b3414b5d970a9b26733c57a4\",\n                            \"lessThan\": \"b0cb4561fc4284d04e69c8a66c8504928ab2484e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"dfe5080939ea4686b3414b5d970a9b26733c57a4\",\n                            \"lessThan\": \"4999fed877bb64e3e7f9ab9996de2ca983c41928\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"dfe5080939ea4686b3414b5d970a9b26733c57a4\",\n                            \"lessThan\": \"2eba3b0cc5b8de624918d21f32b5b8db59a90b39\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"dfe5080939ea4686b3414b5d970a9b26733c57a4\",\n                            \"lessThan\": \"34b2096380ba475771971a778a478661a791aa15\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"dfe5080939ea4686b3414b5d970a9b26733c57a4\",\n                            \"lessThan\": \"8b114f2cc7dd5d36729d040b68432fbd0f0a8868\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"dfe5080939ea4686b3414b5d970a9b26733c57a4\",\n                            \"lessThan\": \"d483c7cc1796bd6a80e7b3a8fd494996260f6b67\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"dfe5080939ea4686b3414b5d970a9b26733c57a4\",\n                            \"lessThan\": \"4e2524ba2ca5f54bdbb9e5153bea00421ef653f5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/ext4/extents.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.18\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.18\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.227\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.168\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.113\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.55\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.10.14\",\n                            \"lessThanOrEqual\": \"6.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.11.3\",\n                            \"lessThanOrEqual\": \"6.11.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/b0cb4561fc4284d04e69c8a66c8504928ab2484e","https://git.kernel.org/stable/c/4999fed877bb64e3e7f9ab9996de2ca983c41928","https://git.kernel.org/stable/c/2eba3b0cc5b8de624918d21f32b5b8db59a90b39","https://git.kernel.org/stable/c/34b2096380ba475771971a778a478661a791aa15","https://git.kernel.org/stable/c/8b114f2cc7dd5d36729d040b68432fbd0f0a8868","https://git.kernel.org/stable/c/d483c7cc1796bd6a80e7b3a8fd494996260f6b67","https://git.kernel.org/stable/c/4e2524ba2ca5f54bdbb9e5153bea00421ef653f5"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-49889","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-49889","identifiers":["CVE-2024-49889"]},"retained":false,"historicalAffected":[]}],"coverage":[]}