VYPR
← All advisories
High severity7.1NVD Advisory· Published Jun 19, 2024· Updated May 12, 2026

CVE-2024-38599

CVE-2024-38599

Description

In the Linux kernel, the following vulnerability has been resolved:

jffs2: prevent xattr node from overflowing the eraseblock

Add a check to make sure that the requested xattr node size is no larger than the eraseblock minus the cleanmarker.

Unlike the usual inode nodes, the xattr nodes aren't split into parts and spread across multiple eraseblocks, which means that a xattr node must not occupy more than one eraseblock. If the requested xattr value is too large, the xattr node can spill onto the next eraseblock, overwriting the nodes and causing errors such as:

jffs2: argh. node added in wrong place at 0x0000b050(2) jffs2: nextblock 0x0000a000, expected at 0000b00c jffs2: error: (823) do_verify_xattr_datum: node CRC failed at 0x01e050, read=0xfc892c93, calc=0x000000 jffs2: notice: (823) jffs2_get_inode_nodes: Node header CRC failed at 0x01e00c. {848f,2fc4,0fef511f,59a3d171} jffs2: Node at 0x0000000c with length 0x00001044 would run over the end of the erase block jffs2: Perhaps the file system was created with the wrong erase size? jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000010: 0x1044 instead

This breaks the filesystem and can lead to KASAN crashes such as:

BUG: KASAN: slab-out-of-bounds in jffs2_sum_add_kvec+0x125e/0x15d0 Read of size 4 at addr ffff88802c31e914 by task repro/830 CPU: 0 PID: 830 Comm: repro Not tainted 6.9.0-rc3+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 Call Trace:

dump_stack_lvl+0xc6/0x120 print_report+0xc4/0x620 ? __virt_addr_valid+0x308/0x5b0 kasan_report+0xc1/0xf0 ? jffs2_sum_add_kvec+0x125e/0x15d0 ? jffs2_sum_add_kvec+0x125e/0x15d0 jffs2_sum_add_kvec+0x125e/0x15d0 jffs2_flash_direct_writev+0xa8/0xd0 jffs2_flash_writev+0x9c9/0xef0 ? __x64_sys_setxattr+0xc4/0x160 ? do_syscall_64+0x69/0x140 ? entry_SYSCALL_64_after_hwframe+0x76/0x7e [...]

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A missing size check in JFFS2 xattr nodes allows overflow into the next eraseblock, causing filesystem corruption and potential kernel crashes.

Vulnerability

CVE-2024-38599 is a vulnerability in the JFFS2 filesystem within the Linux kernel. The issue arises because the kernel did not validate that the size of an extended attribute (xattr) node fits within a single eraseblock, unlike inode nodes which are split across blocks. This oversight permits an xattr node to overflow into the next eraseblock, corrupting metadata and leading to system errors.

Exploitation

An attacker with the ability to setxattr on a JFFS2 filesystem can craft a large xattr value that, when written, produces a node larger than the remaining free space after the cleanmarker. This causes the node to be placed incorrectly, triggering filesystem corruption and potential memory safety violations.

Impact

The corruption manifests as kernel error messages such as "node added in wrong place" and CRC failures, and can escalate to slab-out-of-bounds accesses as demonstrated by KASAN reports, potentially causing system crashes or denial of service. The vulnerability affects Linux systems using JFFS2, including industrial products listed in Siemens advisory [1].

Mitigation

The fix, included in Linux kernel stable branches, adds a check that rejects xattr nodes larger than the usable eraseblock size. Users should apply the latest kernel updates; no workaround is available.

References
  1. SSA-265688

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

147

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.