CVE-2024-26878

MediumCVSS 4.7/10Last modified Oct 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

quota: Fix potential NULL pointer dereference

Below race may cause NULL pointer dereference

P1 P2 dquot_free_inode quota_off drop_dquot_ref remove_dquot_ref dquots = i_dquot(inode) dquots = i_dquot(inode) srcu_read_lock dquots[cnt]) != NULL (1) dquots[type] = NULL (2) spin_lock(&dquots[cnt]->dq_dqb_lock) (3) ....

If dquot_free_inode(or other routines) checks inode's quota pointers (1) before quota_off sets it to NULL(2) and use it (3) after that, NULL pointer dereference will be triggered.

So let's fix it by using a temporary pointer to avoid this issue.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-362CWE-476

Affected software

VendorProductVersions
LinuxLinux>= 7b9ca4c61bc278b771fb57d6290a31ab1fc7fdac, < 8514899c1a4edf802f03c408db901063aa3f05a1; >= 7b9ca4c61bc278b771fb57d6290a31ab1fc7fdac, < 49669f8e7eb053f91d239df7b1bfb4500255a9d0; >= 7b9ca4c61bc278b771fb57d6290a31ab1fc7fdac, < 61380537aa6dd32d8a723d98b8f1bd1b11d8fee0; >= 7b9ca4c61bc278b771fb57d6290a31ab1fc7fdac, < 1ca72a3de915f87232c9a4cb9bebbd3af8ed3e25; >= 7b9ca4c61bc278b771fb57d6290a31ab1fc7fdac, < 7f9e833fc0f9b47be503af012eb5903086939754; >= 7b9ca4c61bc278b771fb57d6290a31ab1fc7fdac, < 40a673b4b07efd6f74ff3ab60f38b26aa91ee5d5; >= 7b9ca4c61bc278b771fb57d6290a31ab1fc7fdac, < f2649d98aa9ca8623149b3cb8df00c944f5655c7; >= 7b9ca4c61bc278b771fb57d6290a31ab1fc7fdac, < 6afc9f4434fa8063aa768c2bf5bf98583aee0877; >= 7b9ca4c61bc278b771fb57d6290a31ab1fc7fdac, < d0aa72604fbd80c8aabb46eda00535ed35570f1f
LinuxLinux4.14
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP>= V3.1.0, < V3.1.5
SiemensSIMATIC S7-1500 TM MFP - GNU/Linux subsystem< V1.1.1
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP>= V3.1.0, < V3.1.5

References

Timeline

Published
Apr 17, 2024
Last modified
Oct 15, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-268795.5In the Linux kernel, the following vulnerability has been resolved: clk: meson: Add missing clocks to axg_clk_regmaps Some clocks were misCVE-2024-26885.4The EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plCVE-2024-268805.5In the Linux kernel, the following vulnerability has been resolved: dm: call the resume method on internal suspend There is this reported CVE-2024-268815.5In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when 1588 is received on HIP08 devices TheCVE-2024-268827.8In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() ApplCVE-2024-268837.8In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stackmap overflow check on 32-bit arches The stackmap code reCVE-2024-268847.8In the Linux kernel, the following vulnerability has been resolved: bpf: Fix hashtab overflow check on 32-bit arches The hashtab code reliCVE-2024-268857.8In the Linux kernel, the following vulnerability has been resolved: bpf: Fix DEVMAP_HASH overflow check on 32-bit arches The devmap code aCVE-2024-268866.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: af_bluetooth: Fix deadlock Attemting to do sock_lock on .reCVE-2024-268875.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: Fix memory leak This checks if CONFIG_DEV_COREDUMP iCVE-2024-268885.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: msft: Fix memory leak Fix leaking buffer allocated to send CVE-2024-268895.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix possible buffer overflow struct hci_dev_info