Security readout for executives and security teams
Plain-English summary
A corrupted directory on an F2FS filesystem can trigger unsafe kernel repair activity during a read-only remount race, potentially causing a kernel panic. Systems using affected Linux kernels with F2FS volumes are the relevant concern. The documented failure is local, not remotely reachable by itself.
Executive priority
Prioritize affected F2FS hosts where local users or workloads are less trusted, and systems where a kernel panic would disrupt critical services. Patch through normal urgent-kernel procedures; exposure is narrower where F2FS is absent.
Technical view
In f2fs_lookup(), online directory repair can dirty data or metadata while racing with a read-only remount. Once read-only, checkpointing skips the dirty inode, which can later trigger a BUG in f2fs_evict_inode. The kernel fix removes this online repair path and delegates recovery to fsck.f2fs.
Likely exposure
Exposure requires an affected Linux kernel, an F2FS filesystem, directory corruption, and the relevant remount race. The bundle lists several affected releases through 6.12, but its version data is inconsistent. Confirm applicability against the distribution’s advisory and backport status.
Exploitation context
The CVSS vector describes a local, low-complexity issue requiring low privileges and no user interaction. CISA KEV status is false, and the supplied sources provide no evidence of active exploitation. The reported reproducer came from syzbot and demonstrated a kernel panic.
Researcher notes
The source describes a race between directory repair and read-only remount handling. The concrete observed outcome is a kernel BUG and panic. Although CVSS assigns high confidentiality, integrity, and availability impacts, the bundle does not document data theft, privilege escalation, public exploit code, or in-the-wild abuse.
Mitigation direction
- Install a vendor-supported kernel containing the applicable stable fix.
- Check distribution advisories because patched package versions may differ from upstream versions.
- Run fsck.f2fs during an approved offline maintenance window for suspected filesystem corruption.
- Restrict untrusted local access until affected systems are patched.
Validation and detection
- Inventory kernel versions and identify systems mounting F2FS filesystems.
- Confirm the installed kernel includes the relevant upstream fix or distribution backport.
- Review kernel logs for F2FS errors, f2fs_evict_inode BUG messages, or unexpected panics.
- Validate suspect F2FS volumes offline using vendor-supported filesystem-checking procedures.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-47690 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e8d64f598eeb079c42a52deaa3a91312c736a49dCVE reference, Linux
- https://git.kernel.org/stable/c/f4746f2d79507f65cfbde11d3c39ee8338aa50afCVE reference, Linux
- https://git.kernel.org/stable/c/f9ce2f550d53d044ecfb5ce996406cf42cd6b84dCVE reference, Linux
- https://git.kernel.org/stable/c/8be95cd607478d85fa4626e86f811e785905bcbfCVE reference, Linux
- https://git.kernel.org/stable/c/bcefd0b0611f35b560d0a7281d87529fbe7a1e32CVE reference, Linux
- https://git.kernel.org/stable/c/884ee6dc85b959bc152f15bca80c30f06069e6c4CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.