In the Linux kernel, the following vulnerability has been resolved:
ext4: fix use-after-free in ext4_rename_dir_prepare
We got issue as follows: EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue ext4_get_first_dir_block: bh->b_data=0xffff88810bee6000 len=34478 ext4_get_first_dir_block: *parent_de=0xffff88810beee6ae bh->b_data=0xffff88810bee6000 ext4_rename_dir_prepare: [1] parent_de=0xffff88810beee6ae ================================================================== BUG: KASAN: use-after-free in ext4_rename_dir_prepare+0x152/0x220 Read of size 4 at addr ffff88810beee6ae by task rep/1895
CPU: 13 PID: 1895 Comm: rep Not tainted 5.10.0+ #241 Call Trace: dump_stack+0xbe/0xf9 print_address_description.constprop.0+0x1e/0x220 kasan_report.cold+0x37/0x7f ext4_rename_dir_prepare+0x152/0x220 ext4_rename+0xf44/0x1ad0 ext4_rename2+0x11c/0x170 vfs_rename+0xa84/0x1440 do_renameat2+0x683/0x8f0 __x64_sys_renameat+0x53/0x60 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f45a6fc41c9 RSP: 002b:00007ffc5a470218 EFLAGS: 00000246 ORIG_RAX: 0000000000000108 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f45a6fc41c9 RDX: 0000000000000005 RSI: 0000000020000180 RDI: 0000000000000005 RBP: 00007ffc5a470240 R08: 00007ffc5a470160 R09: 0000000020000080 R10: 00000000200001c0 R11: 0000000000000246 R12: 0000000000400bb0 R13: 00007ffc5a470320 R14: 0000000000000000 R15: 0000000000000000
The buggy address belongs to the page: page:00000000440015ce refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x10beee flags: 0x200000000000000() raw: 0200000000000000 ffffea00043ff4c8 ffffea0004325608 0000000000000000 raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected
Memory state around the buggy address: ffff88810beee580: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88810beee600: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff88810beee680: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88810beee700: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88810beee780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== Disabling lock debugging due to kernel taint ext4_rename_dir_prepare: [2] parent_de->inode=3537895424 ext4_rename_dir_prepare: [3] dir=0xffff888124170140 ext4_rename_dir_prepare: [4] ino=2 ext4_rename_dir_prepare: ent->dir->i_ino=2 parent=-757071872
Reason is first directory entry which 'rec_len' is 34478, then will get illegal parent entry. Now, we do not check directory entry after read directory block in 'ext4_get_first_dir_block'. To solve this issue, check directory entry in 'ext4_get_first_dir_block'.
[ Trigger an ext4_error() instead of just warning if the directory is missing a '.' or '..' entry. Also make sure we return an error code if the file system is corrupted. -TYT ]
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-livepatch-5.15.50-23.125Upgrade python-perf-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade kernel-livepatch-5.10.126-117.518Upgrade bpftoolUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade perfUpgrade perf-debuginfoUpgrade kernel-develUpgrade python-perfUpgrade kernel-toolsUpgrade kernel-livepatch-4.14.285-215.501Upgrade kernel-tools-devel | Mar 14, 2025 | Feb 26, 2025 |
| Amazon_linux | — | Upgrade kernel | Mar 14, 2025 | Jul 7, 2022 |
| Debian | — | Upgrade linux | Feb 27, 2025 | Feb 27, 2025 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-toolsUpgrade bpftoolUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernelUpgrade python3-perf | Jun 11, 2025 | Feb 26, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade bpftoolUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelists | Jun 11, 2025 | Feb 26, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 26, 2025 |
| Ubuntu | — | Upgrade linux-awsUpgrade linux-raspiUpgrade linux-hweUpgrade linuxUpgrade linux-azure-4.15Upgrade linux-azure-5.4Upgrade linux-gcp-5.15Upgrade linux-azure-fipsUpgrade linux-iotUpgrade linux-intel-iotg-5.15Upgrade linux-hwe-5.15Upgrade linux-kvmUpgrade linux-aws-fipsUpgrade linux-bluefieldUpgrade linux-hwe-5.4Upgrade linux-realtimeUpgrade linux-ibmUpgrade linux-raspi-5.4Upgrade linux-azure-5.15Upgrade linux-gkeopUpgrade linux-azureUpgrade linux-gcp-4.15Upgrade linux-gcp-fipsUpgrade linux-lowlatencyUpgrade linux-nvidiaUpgrade linux-oracle-5.15Upgrade linux-oracleUpgrade linux-lowlatency-hwe-5.15Upgrade linux-gkeUpgrade linux-oracle-5.4Upgrade linux-gcpUpgrade linux-ibm-5.4Upgrade linux-aws-5.4Upgrade linux-riscv-5.15Upgrade linux-intel-iotgUpgrade linux-gcp-5.4Upgrade linux-aws-5.15Upgrade linux-fipsUpgrade linux-aws-hwe | Mar 3, 2025 | Feb 26, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Feb 26, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub