VYPR
← All advisories
High severity7.8NVD Advisory· Published Oct 21, 2024· Updated May 12, 2026

CVE-2024-49884

CVE-2024-49884

Description

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix slab-use-after-free in ext4_split_extent_at()

We hit the following use-after-free:

================================================================== BUG: KASAN: slab-use-after-free in ext4_split_extent_at+0xba8/0xcc0 Read of size 2 at addr ffff88810548ed08 by task kworker/u20:0/40 CPU: 0 PID: 40 Comm: kworker/u20:0 Not tainted 6.9.0-dirty #724 Call Trace:

kasan_report+0x93/0xc0 ext4_split_extent_at+0xba8/0xcc0 ext4_split_extent.isra.0+0x18f/0x500 ext4_split_convert_extents+0x275/0x750 ext4_ext_handle_unwritten_extents+0x73e/0x1580 ext4_ext_map_blocks+0xe20/0x2dc0 ext4_map_blocks+0x724/0x1700 ext4_do_writepages+0x12d6/0x2a70 [...]

Allocated by task 40: __kmalloc_noprof+0x1ac/0x480 ext4_find_extent+0xf3b/0x1e70 ext4_ext_map_blocks+0x188/0x2dc0 ext4_map_blocks+0x724/0x1700 ext4_do_writepages+0x12d6/0x2a70 [...]

Freed by task 40: kfree+0xf1/0x2b0 ext4_find_extent+0xa71/0x1e70 ext4_ext_insert_extent+0xa22/0x3260 ext4_split_extent_at+0x3ef/0xcc0 ext4_split_extent.isra.0+0x18f/0x500 ext4_split_convert_extents+0x275/0x750 ext4_ext_handle_unwritten_extents+0x73e/0x1580 ext4_ext_map_blocks+0xe20/0x2dc0 ext4_map_blocks+0x724/0x1700 ext4_do_writepages+0x12d6/0x2a70 [...] ==================================================================

The flow of issue triggering is as follows:

ext4_split_extent_at path = *ppath ext4_ext_insert_extent(ppath) ext4_ext_create_new_leaf(ppath) ext4_find_extent(orig_path) path = *orig_path read_extent_tree_block // return -ENOMEM or -EIO ext4_free_ext_path(path) kfree(path) *orig_path = NULL a. If err is -ENOMEM: ext4_ext_dirty(path + path->p_depth) // path use-after-free !!! b. If err is -EIO and we have EXT_DEBUG defined: ext4_ext_show_leaf(path) eh = path[depth].p_hdr // path also use-after-free !!!

So when trying to zeroout or fix the extent length, call ext4_find_extent() to update the path.

In addition we use *ppath directly as an ext4_ext_show_leaf() input to avoid possible use-after-free when EXT_DEBUG is defined, and to avoid unnecessary path updates.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A slab-use-after-free vulnerability in ext4_split_extent_at() in the Linux kernel ext4 filesystem can be triggered when memory allocation fails during extent splitting, leading to a use-after-free of the path structure.

Vulnerability

CVE-2024-49884 is a use-after-free vulnerability in the Linux kernel's ext4 filesystem, specifically in the ext4_split_extent_at() function. The root cause is that when ext4_ext_insert_extent() is called within ext4_split_extent_at() and fails (e.g., due to memory allocation errors or I/O errors), the path pointer *ppath can be freed and set to NULL by ext4_find_extent(). However, after the error, ext4_split_extent_at() continues to use the now-dangling path pointer for operations like ext4_ext_dirty() or ext4_ext_show_leaf(), resulting in a slab-use-after-free condition [1][2].

Exploitation

The vulnerability is triggered during filesystem write operations. The call trace shows the bug occurs in the context of ext4_do_writepages(), which is part of the writeback path. An attacker needs to be able to trigger error conditions (such as -ENOMEM or -EIO) during extent splitting. This could be achieved by exhausting memory or causing I/O errors on the block device. The attack requires the ability to perform write operations to an ext4 filesystem, and the bug is reachable without special privileges beyond normal file write access [3]. The use-after-free occurs on a struct ext4_ext_path that was allocated via kmalloc and then freed improperly.

Impact

A successful exploit could lead to a system crash (denial of service) due to memory corruption. In more severe scenarios, an attacker might be able to leverage the use-after-free to corrupt kernel memory or potentially escalate privileges, though the upstream description focuses on the crash [4]. The CVSS v3 base score of 7.8 (High) reflects the potential for high impact on confidentiality, integrity, and availability, given the privileged access required (local, low complexity).

Mitigation

The vulnerability was fixed in the Linux kernel stable releases. The fix ensures that after ext4_ext_insert_extent() fails, the code updates the local path pointer to the new value from *ppath, which may be NULL, and avoids dereferencing the freed path. Users should apply kernel updates that include the commit referenced in the stable notifications.

References
  1. Making sure you're not a bot!
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

126

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

11

News mentions

0

No linked articles in our index yet.