Description
In the Linux kernel, the following vulnerability has been resolved: nilfs2: protect access to buffers with no active references nilfs_lookup_dirty_data_buffers(), which iterates through the buffers attached to dirty data folios/pages, accesses the attached buffers without locking the folios/pages. For data cache, nilfs_clear_folio_dirty() may be called asynchronously when the file system degenerates to read only, so nilfs_lookup_dirty_data_buffers() still has the potential to cause use after free issues when buffers lose the protection of their dirty state midway due to this asynchronous clearing and are unintentionally freed by try_to_free_buffers(). Eliminate this race issue by adjusting the lock section in this function.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
8c26c4e2694a163d525976e804d81cd955bbb40c to < e1fc4a90a90ea8514246c45435662531975937d9affected8c26c4e2694a163d525976e804d81cd955bbb40c to < 72cf688d0ce7e642b12ddc9b2a42524737ec1b4aaffected8c26c4e2694a163d525976e804d81cd955bbb40c to < d8ff250e085a4c4cdda4ad1cdd234ed110393143affected8c26c4e2694a163d525976e804d81cd955bbb40c to < 58c27fa7a610b6e8d44e6220e7dbddfbaccaf439affected8c26c4e2694a163d525976e804d81cd955bbb40c to < 8e1b9201c9a24638cf09c6e1c9f224157328010baffected8c26c4e2694a163d525976e804d81cd955bbb40c to < 4b08d23d7d1917bef4fbee8ad81372f49b006656affected8c26c4e2694a163d525976e804d81cd955bbb40c to < c437dfac9f7a5a46ac2a5e6d6acd3059e9f68188affected8c26c4e2694a163d525976e804d81cd955bbb40c to < 367a9bffabe08c04f6d725032cce3d891b2b9e1aaffected
Linux Linux
Default version status: affected
3.10affected0 to < 3.10unaffected5.4.291 to ≤ 5.4.*unaffected5.10.235 to ≤ 5.10.*unaffected5.15.179 to ≤ 5.15.*unaffected6.1.129 to ≤ 6.1.*unaffected6.6.76 to ≤ 6.6.*unaffected6.12.13 to ≤ 6.12.*unaffected6.13.2 to ≤ 6.13.*unaffected6.14 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/e1fc4a90a90ea8514246c45435662531975937d9 ↗
- https://git.kernel.org/stable/c/72cf688d0ce7e642b12ddc9b2a42524737ec1b4a ↗
- https://git.kernel.org/stable/c/d8ff250e085a4c4cdda4ad1cdd234ed110393143 ↗
- https://git.kernel.org/stable/c/58c27fa7a610b6e8d44e6220e7dbddfbaccaf439 ↗
- https://git.kernel.org/stable/c/8e1b9201c9a24638cf09c6e1c9f224157328010b ↗
- https://git.kernel.org/stable/c/4b08d23d7d1917bef4fbee8ad81372f49b006656 ↗
- https://git.kernel.org/stable/c/c437dfac9f7a5a46ac2a5e6d6acd3059e9f68188 ↗
- https://git.kernel.org/stable/c/367a9bffabe08c04f6d725032cce3d891b2b9e1a ↗
- https://lists.debian.org/debian-lts-announce/2025/05/msg00030.html ↗
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html ↗