nilfs2: fix failure to detect DAT corruption in btree and direct mappings

{
  "id": "9abc9a70e80ca9955ec6d315e627703ff3b24cdd8b9ef651c318997b7a270ea0",
  "url": "https://osv.dev/vulnerability/CVE-2024-26956",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "nilfs2: fix failure to detect DAT corruption in btree and direct mappings",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix failure to detect DAT corruption in btree and direct mappings Patch series \"nilfs2: fix kernel bug at submit_bh_wbc()\". This resolves a kernel BUG reported by syzbot. Since there are two flaws involved, I've made each one a separate patch. The first patch alone resolves the syzbot-reported bug, but I think both fixes should be sent to stable, so I've tagged them as such. This patch (of 2): Syzbot has reported a kernel bug in submit_bh_wbc() when writing file data to a nilfs2 file system whose metadata is corrupted. There are two flaws involved in this issue. The first flaw is that when nilfs_get_block() locates a data block using btree or direct mapping, if the disk address translation routine nilfs_dat_translate() fails with internal code -ENOENT due to DAT metadata corruption, it can be passed back to nilfs_get_block(). This causes nilfs_get_block() to misidentify an existing block as non-existent, causing both data block lookup and insertion to fail inconsistently. The second flaw is that nilfs_get_block() returns a successful status in this inconsistent state. This causes the caller __block_write_begin_int() or others to request a read even though the buffer is not mapped, resulting in a BUG_ON check for the BH_Mapped flag in submit_bh_wbc() failing. This fixes the first issue by changing the return value to code -EINVAL when a conversion using DAT fails with code -ENOENT, avoiding the conflic",
    "evidence": "osv:CVE-2024-26956",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "4.19.312",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.4.274",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.10.215",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.154",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.84",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.24",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.7.12",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.8.3",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "CVE-2024-26956",
      "aliases": [
        "CVE-2024-26956"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "c3a7abf06ce719a51139e62a034590be99abbc2c"
                },
                {
                  "fixed": "b67189690eb4b7ecc84ae16fa1e880e0123eaa35"
                },
                {
                  "fixed": "9cbe1ad5f4354f4df1445e5f4883983328cd6d8e"
                },
                {
                  "fixed": "c3b5c5c31e723b568f83d8cafab8629d9d830ffb"
                },
                {
                  "fixed": "2e2619ff5d0def4bb6c2037a32a6eaa28dd95c84"
                },
                {
                  "fixed": "46b832e09d43b394ac0f6d9485d2b1a06593f0b7"
                },
                {
                  "fixed": "f69e81396aea66304d214f175aa371f1b5578862"
                },
                {
                  "fixed": "a8e4d098de1c0f4c5c1f2ed4633a860f0da6d713"
                },
                {
                  "fixed": "82827ca21e7c8a91384c5baa656f78a5adfa4ab4"
                },
                {
                  "fixed": "f2f26b4a84a0ef41791bd2d70861c8eac748f4ba"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26956.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "2.6.31"
                },
                {
                  "fixed": "4.19.312"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.20.0"
                },
                {
                  "fixed": "5.4.274"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.5.0"
                },
                {
                  "fixed": "5.10.215"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.154"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.84"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.24"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.7.12"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.8.0"
                },
                {
                  "fixed": "6.8.3"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26956.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:38.736868771Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/2e2619ff5d0def4bb6c2037a32a6eaa28dd95c84",
        "https://git.kernel.org/stable/c/46b832e09d43b394ac0f6d9485d2b1a06593f0b7",
        "https://git.kernel.org/stable/c/82827ca21e7c8a91384c5baa656f78a5adfa4ab4",
        "https://git.kernel.org/stable/c/9cbe1ad5f4354f4df1445e5f4883983328cd6d8e",
        "https://git.kernel.org/stable/c/a8e4d098de1c0f4c5c1f2ed4633a860f0da6d713",
        "https://git.kernel.org/stable/c/b67189690eb4b7ecc84ae16fa1e880e0123eaa35",
        "https://git.kernel.org/stable/c/c3b5c5c31e723b568f83d8cafab8629d9d830ffb",
        "https://git.kernel.org/stable/c/f2f26b4a84a0ef41791bd2d70861c8eac748f4ba",
        "https://git.kernel.org/stable/c/f69e81396aea66304d214f175aa371f1b5578862",
        "https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html",
        "https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26956.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2024-26956",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26956.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2024-26956",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 505980,
  "published_at": "2024-05-01T05:18:56.101+00:00"
}