Not rated

CVE-2024-26878 In the Linux kernel, the following vulnerability has been resolved: quota: Fix potential NULL pointer dereference…

Description

In the Linux kernel, the following vulnerability has been resolved: quota: Fix potential NULL pointer dereference Below race may cause NULL pointer dereference P1 P2 dquot_free_inode quota_off drop_dquot_ref remove_dquot_ref dquots = i_dquot(inode) dquots = i_dquot(inode) srcu_read_lock dquots[cnt]) != NULL (1) dquots[type] = NULL (2) spin_lock(&dquots[cnt]->dq_dqb_lock) (3) .... If dquot_free_inode(or other routines) checks inode's quota pointers (1) before quota_off sets it to NULL(2) and use it (3) after that, NULL pointer dereference will be triggered. So let's fix it by using a temporary pointer to avoid this issue.

Affected products and versions

Product	Affected versions	Fixed in
Linux 6.9	earliest → < 6.9	6.9
Linux 6.8	earliest → < 6.8.2	6.8.2
Linux 6.7	earliest → < 6.7.11	6.7.11
Linux 6.6	earliest → < 6.6.23	6.6.23
Linux 6.1	earliest → < 6.1.83	6.1.83
Linux 5.15	earliest → < 5.15.153	5.15.153
Linux 5.10	earliest → < 5.10.214	5.10.214
Linux 5.4	earliest → < 5.4.273	5.4.273
Linux 4.19	earliest → < 4.19.311	4.19.311

Show the 5 other branches

Product	Affected versions	Fixed in
Linux	4.14	No fix stated
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem 1.1	earliest → < 1.1.1	1.1.1
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1	3.1.0 → < 3.1.5	3.1.5
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1	3.1.0 → < 3.1.5	3.1.5
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1	3.1.0 → < 3.1.5	3.1.5