Vulnerability identifier: #VU91535

Vulnerability risk: Low

CVSSv3.1: 4.8 [AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-26644

CWE-ID: CWE-667

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the create_snapshot() function in fs/btrfs/ioctl.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel:

---

External links
http://git.kernel.org/stable/c/2bdf872bcfe629a6202ffd6641615a8ed00e8464
http://git.kernel.org/stable/c/0877497dc97834728e1b528ddf1e1c484292c29c
http://git.kernel.org/stable/c/6e6bca99e8d88d989a7cde4c064abea552d5219b
http://git.kernel.org/stable/c/ec794a7528199e1be6d47bec03f4755aa75df256
http://git.kernel.org/stable/c/d8680b722f0ff6d7a01ddacc1844e0d52354d6ff
http://git.kernel.org/stable/c/7081929ab2572920e94d70be3d332e5c9f97095a

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.