CVE - CVE-2024-26590

CVE-ID
CVE-2024-26590	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: erofs: fix inconsistent per-file compression format EROFS can select compression algorithms on a per-file basis, and each per-file compression algorithm needs to be marked in the on-disk superblock for initialization. However, syzkaller can generate inconsistent crafted images that use an unsupported algorithmtype for specific inodes, e.g. use MicroLZMA algorithmtype even it's not set in `sbi->available_compr_algs`. This can lead to an unexpected "BUG: kernel NULL pointer dereference" if the corresponding decompressor isn't built-in. Fix this by checking against `sbi->available_compr_algs` for each m_algorithmformat request. Incorrect !erofs_sb_has_compr_cfgs preset bitmap is now fixed together since it was harmless previously.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/118a8cf504d7dfa519562d000f423ee3ca75d2c4 URL:https://git.kernel.org/stable/c/118a8cf504d7dfa519562d000f423ee3ca75d2c4 MISC:https://git.kernel.org/stable/c/47467e04816cb297905c0f09bc2d11ef865942d9 URL:https://git.kernel.org/stable/c/47467e04816cb297905c0f09bc2d11ef865942d9 MISC:https://git.kernel.org/stable/c/823ba1d2106019ddf195287ba53057aee33cf724 URL:https://git.kernel.org/stable/c/823ba1d2106019ddf195287ba53057aee33cf724 MISC:https://git.kernel.org/stable/c/eed24b816e50c6cd18cbee0ff0d7218c8fced199 URL:https://git.kernel.org/stable/c/eed24b816e50c6cd18cbee0ff0d7218c8fced199
Assigning CNA
kernel.org
Date Record Created
20240219	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240219)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)