CVE-2024-37078: Linux vulnerability

CVE-2024-37078: nilfs2: fix potential kernel bug due to lack of writeback flag waiting

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential kernel bug due to lack of writeback flag waiting Destructive writes to a block device on which nilfs2 is mounted can cause a kernel bug in the folio/page writeback start routine or writeback end routine (__folio_start_writeback in the log below): kernel BUG at mm/page-writeback.c:3070! Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI ... RIP: 0010:__folio_start_writeback+0xbaa/0x10e0 Code: 25 ff 0f 00 00 0f 84 18 01 00 00 e8 40 ca c6 ff e9 17 f6 ff ff e8 36 ca c6 ff 4c 89 f7 48 c7 c6 80 c0 12 84 e8 e7 b3 0f 00 90 <0f> 0b e8 1f ca c6 ff 4c 89 f7 48 c7 c6 a0 c6 12 84 e8 d0 b3 0f 00 ... Call Trace: <TASK> nilfs_segctor_do_construct+0x4654/0x69d0 [nilfs2] nilfs_segctor_construct+0x181/0x6b0 [nilfs2] nilfs_segctor_thread+0x548/0x11c0 [nilfs2] kthread+0x2f0/0x390 ret_from_fork+0x4b/0x80 ret_from_fork_asm+0x1a/0x30 </TASK> This is because when the log writer starts a writeback for segment summary blocks or a super root block that use the backing device's page cache, it does not wait for the ongoing folio/page writeback, resulting in an inconsistent writeback state. Fix this issue by waiting for ongoing writebacks when putting folios/pages on the backing device into writeback state.

UnknownCVSS not scoredNot KEV-listedUpdatedMay 11, 2026, 20:18 UTC (UTC+00:00)

Security readout for executives and security teams

Plain-English summary

CVE-2024-37078 is a Linux kernel nilfs2 filesystem bug that can crash the kernel when destructive writes hit a block device that is still mounted with nilfs2. Business impact is mainly availability: affected systems could panic or fail, but the sources do not show remote exploitation or active attacks.

Executive priority

Treat this as a targeted availability issue. Patch during normal kernel maintenance unless nilfs2 is deployed on critical hosts or block-device access is weakly controlled; those systems deserve faster remediation because a kernel crash can disrupt services.

Technical view

nilfs2 starts writeback for segment summary or super root blocks using the backing device page cache without waiting for ongoing folio/page writeback. That can create inconsistent writeback state and trigger a kernel BUG in page-writeback routines. The upstream fix waits for ongoing writebacks before setting folios/pages into writeback state.

Likely exposure

Exposure is likely limited to Linux systems using mounted nilfs2 filesystems where a local user, privileged process, or misconfigured workload can perform destructive writes to the same block device. nilfs2 is not commonly enabled in typical enterprise server builds, so asset inventory matters.

Exploitation context

The CVE source describes a crash condition caused by destructive writes to a mounted nilfs2 block device. CISA KEV is false in the bundle, and no cited source states active exploitation. The available evidence supports local availability risk, not confirmed remote compromise.

Researcher notes

The source bundle provides upstream stable fix commits and a Debian LTS advisory, but no CVSS, CWE, or exploit confirmation. Affected version data is broad, so validate against kernel source, distro backports, and actual nilfs2 usage before declaring exposure.

Mitigation direction

Apply kernel updates containing the listed stable nilfs2 fixes or distro backports.
Check Linux distribution advisories for exact fixed package versions.
Avoid mounting nilfs2 on systems exposed to untrusted local workloads.
Restrict direct block-device write access while filesystems are mounted.
Prioritize hosts where storage disruption affects production availability.

Validation and detection

Inventory systems with nilfs2 support enabled or nilfs2 filesystems mounted.
Compare running kernel builds against vendor fixed versions or listed stable commits.
Review logs for kernel BUG traces involving page-writeback and nilfs2 segment construction.
Confirm untrusted users and containers lack direct write access to mounted block devices.
Track Debian LTS or other distro advisories for package-specific remediation status.

Prepared: May 22, 2026, 04:19 UTC (UTC+00:00)
Confidence: medium
Sources: 11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-37078 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Jun 25, 2024, 14:22 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

3Timeline events

2ADP providers

10Source links

SSVC decision data

Timestamp: Sep 10, 2024, 17:08 UTC (UTC+00:00)
Version: 2.0.3

Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
Jun 24, 2024, 13:54 UTC (UTC+00:00)
CVE publishedCVE Program
The CVE record was published.
Jun 25, 2024, 14:22 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
May 11, 2026, 20:18 UTC (UTC+00:00)

ADP provider summaries

other:ssvc

Source materials

CVE List V5 sourceCVE List V5
https://git.kernel.org/stable/c/95f6f81e50d858a7c9aa7c795ec14a0ac3819118CVE reference, Linux
https://git.kernel.org/stable/c/a75b8f493dfc48aa38c518430bd9e03b53bffebeCVE reference, Linux
https://git.kernel.org/stable/c/0ecfe3a92869a59668d27228dabbd7965e83567fCVE reference, Linux
https://git.kernel.org/stable/c/33900d7eae616647e179eee1c66ebe654ee39627CVE reference, Linux
https://git.kernel.org/stable/c/271dcd977ccda8c7a26e360425ae7b4db7d2ecc0CVE reference, Linux
https://git.kernel.org/stable/c/614d397be0cf43412b3f94a0f6460eddced8ce92CVE reference, Linux
https://git.kernel.org/stable/c/1f3bff69f1214fe03a02bc650d5bbfaa6e65ae7dCVE reference, Linux
https://git.kernel.org/stable/c/a4ca369ca221bb7e06c725792ac107f0e48e82e7CVE reference, Linux
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

LinuxLinux9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453, 9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453, 9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453, 9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453, 9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453, 9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453, 9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453, 9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453unaffected

LinuxLinux2.6.30, 0, 4.19.317, 5.4.279, 5.10.221, 5.15.162, 6.1.95, 6.6.35, 6.9.5, 6.10affected

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.