LiveActive security incident?Get immediate response
CVE Record

CVE-2024-43828: ext4: fix infinite loop when replaying fast_commit

In the Linux kernel, the following vulnerability has been resolved: ext4: fix infinite loop when replaying fast_commit When doing fast_commit replay an infinite loop may occur due to an uninitialized extent_status struct. ext4_ext_determine_insert_hole() does not detect the replay and calls ext4_es_find_extent_range(), which will return immediately without initializing the 'es' variable. Because 'es' contains garbage, an integer overflow may happen causing an infinite loop in this function, easily reproducible using fstest generic/039. This commit fixes this issue by unconditionally initializing the structure in function ext4_es_find_extent_range(). Thanks to Zhang Yi, for figuring out the real problem!

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2024-43828 is a Linux kernel ext4 filesystem bug. During fast_commit journal replay, the kernel can enter an infinite loop because an internal structure is not initialized. The likely business impact is availability: affected systems may hang during filesystem recovery, especially after an unclean shutdown or similar recovery event.

Executive priority

Treat this as a moderate availability risk. It is not supported as actively exploited by the supplied evidence, but kernel filesystem hangs can disrupt recovery and uptime on important Linux systems. Patch through normal kernel maintenance, faster for critical ext4-dependent systems.

Technical view

The ext4 fast_commit replay path can call ext4_es_find_extent_range(), which returns without initializing an extent_status structure. Garbage values may trigger integer overflow and an infinite loop. The upstream fix initializes the structure unconditionally. The CVE bundle references multiple Linux stable commits and downstream Debian and Siemens advisories.

Likely exposure

Exposure is most likely on Linux systems using ext4 where affected kernel builds include the vulnerable fast_commit replay behavior. The bundle does not provide complete distro-specific affected package ranges, so organizations should map kernel versions against vendor advisories and the referenced stable fixes.

Exploitation context

The provided sources do not show CISA KEV listing or active exploitation. The described trigger is fast_commit replay, suggesting a reliability and denial-of-service concern around filesystem recovery rather than remote code execution. Public exploit status is not established in the supplied bundle.

Researcher notes

The key defect is uninitialized extent_status data during ext4 fast_commit replay, with possible integer overflow leading to an infinite loop. The source bundle names upstream stable commits but lacks CVSS, CWE, and complete distro package ranges, so validation should rely on vendor kernel provenance.

Mitigation direction

  • Apply vendor kernel updates that include the referenced ext4 fast_commit replay fix.
  • Prioritize systems using ext4 on critical servers, appliances, and recovery-sensitive workloads.
  • Check Debian, Siemens, and Linux vendor advisories for package-specific fixed versions.
  • Schedule reboots where required to ensure the fixed kernel is actually running.
  • If updates are unavailable, follow vendor guidance for risk reduction.

Validation and detection

  • Inventory Linux hosts and identify systems using ext4 filesystems.
  • Record running kernel versions and compare them with vendor fixed-version guidance.
  • Confirm the referenced upstream fix is present in deployed kernel builds.
  • Review system logs for ext4 recovery hangs or repeated replay failures.
  • After patching, verify hosts boot into the updated kernel.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-43828 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
3ADP providers
10Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container
siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2, 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2, 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2, 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2, 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2, 8016e29f4362e285f0f7e38fadc61a5b7bdfdfa2unaffected
LinuxLinux5.10, 0, 5.10.224, 5.15.165, 6.1.103, 6.6.44, 6.10.3, 6.11affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.