LiveActive security incident?Get immediate response
CVE Record

CVE-2024-26697: nilfs2: fix data corruption in dsync block recovery for small block sizes

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix data corruption in dsync block recovery for small block sizes The helper function nilfs_recovery_copy_block() of nilfs_recovery_dsync_blocks(), which recovers data from logs created by data sync writes during a mount after an unclean shutdown, incorrectly calculates the on-page offset when copying repair data to the file's page cache. In environments where the block size is smaller than the page size, this flaw can cause data corruption and leak uninitialized memory bytes during the recovery process. Fix these issues by correcting this byte offset calculation on the page.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux NILFS2 recovery bug can corrupt files and expose uninitialized memory when a filesystem is mounted after an unclean shutdown. The vulnerable condition requires filesystem blocks smaller than the system page size. Impact can affect confidentiality, integrity, and availability, but exposure is limited to systems using NILFS2 under these conditions.

Executive priority

Treat this as a high-priority, environment-dependent kernel update. Accelerate remediation where NILFS2 is used with small blocks, especially on systems holding sensitive or integrity-critical data. Other Linux systems should follow normal kernel patching after confirming they do not use the affected configuration.

Technical view

nilfs_recovery_copy_block() calculates the page-cache destination offset incorrectly during nilfs_recovery_dsync_blocks(). When the NILFS2 block size is smaller than the memory page size, recovery of data-sync logs after an unclean shutdown can copy repair data to the wrong location, causing corruption and disclosure of uninitialized bytes. CVSS 3.1 is 7.8 with local, low-privilege access assumed.

Likely exposure

Highest exposure is on Linux systems that mount NILFS2 filesystems, use blocks smaller than the memory page size, and perform recovery after an unclean shutdown. Systems not using NILFS2, or without the small-block condition, are not described as vulnerable. Exact distribution package ranges require vendor confirmation.

Exploitation context

The bundle does not establish active exploitation, and the CVE is not listed as KEV. The CVSS vector describes local access with low privileges and no user interaction, but the sources do not prove that an attacker can reliably force every prerequisite, including an unclean shutdown and recovery mount.

Researcher notes

The vulnerable path is post-crash data-sync log recovery, not routine filesystem I/O. The source bundle provides multiple Linux stable commits, but its version presentation is insufficient for reliable distribution-level package mapping. Validate fixes through the relevant vendor advisory and package changelog. No cited evidence demonstrates public exploitation or a reliable attack chain.

Mitigation direction

  • Install a vendor-supported kernel containing the referenced NILFS2 offset correction.
  • Prioritize systems actively mounting NILFS2 with block sizes smaller than the system page size.
  • Where operationally feasible, avoid mounting affected NILFS2 filesystems until the corrected kernel is installed.
  • Check Linux distribution advisories for package-specific fixed versions and reboot requirements.

Validation and detection

  • Inventory hosts that load or mount NILFS2 filesystems.
  • Compare each NILFS2 filesystem block size with its host memory page size.
  • Verify installed kernel packages against distribution advisories or the referenced stable fixes.
  • Confirm affected hosts booted into the corrected kernel after updating.
  • Review recovery events following unclean shutdowns for possible corruption or unintended data exposure.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-26697 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
11Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-26697Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b, 0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b, 0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b, 0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b, 0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b, 0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b, 0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4b, 0f3e1c7f23f8a6f8224fa1d275381f6d9279ad4bunaffected
LinuxLinux2.6.30, 0, 4.19.307, 5.4.269, 5.10.210, 5.15.149, 6.1.79, 6.6.18, 6.7.6, 6.8affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.