CVE-2024-26704

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix double-free of blocks due to wrong extents moved_len

In ext4_move_extents(), moved_len is only updated when all moves are

successfully executed, and only discards orig_inode and donor_inode

preallocations when moved_len is not zero. When the loop fails to exit

after successfully moving some extents, moved_len is not updated and

remains at 0, so it does not discard the preallocations.

If the moved extents overlap with the preallocated extents, the

overlapped extents are freed twice in ext4_mb_release_inode_pa() and

ext4_process_freed_data() (as described in commit 94d7c16cbbbd ("ext4:

Fix double-free of blocks with EXT4_IOC_MOVE_EXT")), and bb_free is

incremented twice. Hence when trim is executed, a zero-division bug is

triggered in mb_update_avg_fragment_size() because bb_free is not zero

and bb_fragments is zero.

Therefore, update move_len after each extent move to avoid the issue.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References