VYPR
← All advisories
High severity7.8NVD Advisory· Published Oct 21, 2024· Updated May 12, 2026

CVE-2024-49883

CVE-2024-49883

Description

In the Linux kernel, the following vulnerability has been resolved:

ext4: aovid use-after-free in ext4_ext_insert_extent()

As Ojaswin mentioned in Link, in ext4_ext_insert_extent(), if the path is reallocated in ext4_ext_create_new_leaf(), we'll use the stale path and cause UAF. Below is a sample trace with dummy values:

ext4_ext_insert_extent path = *ppath = 2000 ext4_ext_create_new_leaf(ppath) ext4_find_extent(ppath) path = *ppath = 2000 if (depth > path[0].p_maxdepth) kfree(path = 2000); *ppath = path = NULL; path = kcalloc() = 3000 *ppath = 3000; return path; /* here path is still 2000, UAF! */ eh = path[depth].p_hdr

================================================================== BUG: KASAN: slab-use-after-free in ext4_ext_insert_extent+0x26d4/0x3330 Read of size 8 at addr ffff8881027bf7d0 by task kworker/u36:1/179 CPU: 3 UID: 0 PID: 179 Comm: kworker/u6:1 Not tainted 6.11.0-rc2-dirty #866 Call Trace:

ext4_ext_insert_extent+0x26d4/0x3330 ext4_ext_map_blocks+0xe22/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 [...]

Allocated by task 179: ext4_find_extent+0x81c/0x1f70 ext4_ext_map_blocks+0x146/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 ext4_writepages+0x26d/0x4e0 do_writepages+0x175/0x700 [...]

Freed by task 179: kfree+0xcb/0x240 ext4_find_extent+0x7c0/0x1f70 ext4_ext_insert_extent+0xa26/0x3330 ext4_ext_map_blocks+0xe22/0x2d40 ext4_map_blocks+0x71e/0x1700 ext4_do_writepages+0x1290/0x2800 ext4_writepages+0x26d/0x4e0 do_writepages+0x175/0x700 [...] ==================================================================

So use *ppath to update the path to avoid the above problem.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A use-after-free vulnerability in Linux kernel's ext4 filesystem, exploitable by local attackers via crafted writes, leads to privilege escalation.

Vulnerability

Overview CVE-2024-49883 is a use-after-free (UAF) vulnerability in the Linux kernel's ext4 filesystem, specifically in the ext4_ext_insert_extent() function. The root cause is a failure to update the local path pointer after ext4_ext_create_new_leaf() reallocates the path structure. If ext4_find_extent() is called within ext4_ext_create_new_leaf() and the depth of the extent tree changes, the old path is freed and a new one allocated; however, ext4_ext_insert_extent() continues to use the stale pointer, leading to a UAF condition.

Exploitation and

Impact To trigger the bug, an attacker must be able to perform write operations on a filesystem that uses ext4's extent-based mapping. The vulnerability occurs during page writeback, as demonstrated in the KASAN report where a kworker task (PID 179) triggers the UAF during ext4_do_writepages. A local attacker with the ability to write to the filesystem can craft operations that cause the extent tree to grow, inducing the reallocation race. Successful exploitation could lead to memory corruption, potentially resulting in privilege escalation or system compromise.

Mitigation

This vulnerability is fixed in Linux kernel stable releases, with patches backported to multiple stable kernel versions [1][2][3][4]. Users are advised to update their kernels to the latest stable releases that include the fix. The fix involves using *ppath (the pointer-to-pointer) to update the local path variable, ensuring the correct and alive path is always used.

References
  1. Making sure you're not a bot!
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

113

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.