{"api_version":"1","generated_at":"2026-08-24T09:30:13+00:00","cve":"CVE-2024-49958","urls":{"html":"https://cve.report/CVE-2024-49958","api":"https://cve.report/api/cve/CVE-2024-49958.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2024-49958","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-49958"},"summary":{"title":"ocfs2: reserve space for inline xattr before attaching reflink tree","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: reserve space for inline xattr before attaching reflink tree\n\nOne of our customers reported a crash and a corrupted ocfs2 filesystem. \nThe crash was due to the detection of corruption.  Upon troubleshooting,\nthe fsck -fn output showed the below corruption\n\n[EXTENT_LIST_FREE] Extent list in owner 33080590 claims 230 as the next free chain record,\nbut fsck believes the largest valid value is 227.  Clamp the next record value? n\n\nThe stat output from the debugfs.ocfs2 showed the following corruption\nwhere the \"Next Free Rec:\" had overshot the \"Count:\" in the root metadata\nblock.\n\n        Inode: 33080590   Mode: 0640   Generation: 2619713622 (0x9c25a856)\n        FS Generation: 904309833 (0x35e6ac49)\n        CRC32: 00000000   ECC: 0000\n        Type: Regular   Attr: 0x0   Flags: Valid\n        Dynamic Features: (0x16) HasXattr InlineXattr Refcounted\n        Extended Attributes Block: 0  Extended Attributes Inline Size: 256\n        User: 0 (root)   Group: 0 (root)   Size: 281320357888\n        Links: 1   Clusters: 141738\n        ctime: 0x66911b56 0x316edcb8 -- Fri Jul 12 06:02:30.829349048 2024\n        atime: 0x66911d6b 0x7f7a28d -- Fri Jul 12 06:11:23.133669517 2024\n        mtime: 0x66911b56 0x12ed75d7 -- Fri Jul 12 06:02:30.317552087 2024\n        dtime: 0x0 -- Wed Dec 31 17:00:00 1969\n        Refcount Block: 2777346\n        Last Extblk: 2886943   Orphan Slot: 0\n        Sub Alloc Slot: 0   Sub Alloc Bit: 14\n        Tree Depth: 1   Count: 227   Next Free Rec: 230\n        ## Offset        Clusters       Block#\n        0  0             2310           2776351\n        1  2310          2139           2777375\n        2  4449          1221           2778399\n        3  5670          731            2779423\n        4  6401          566            2780447\n        .......          ....           .......\n        .......          ....           .......\n\nThe issue was in the reflink workfow while reserving space for inline\nxattr.  The problematic function is ocfs2_reflink_xattr_inline().  By the\ntime this function is called the reflink tree is already recreated at the\ndestination inode from the source inode.  At this point, this function\nreserves space for inline xattrs at the destination inode without even\nchecking if there is space at the root metadata block.  It simply reduces\nthe l_count from 243 to 227 thereby making space of 256 bytes for inline\nxattr whereas the inode already has extents beyond this index (in this\ncase up to 230), thereby causing corruption.\n\nThe fix for this is to reserve space for inline metadata at the destination\ninode before the reflink tree gets recreated. The customer has verified the\nfix.","state":"PUBLISHED","assigner":"Linux","published_at":"2024-10-21 18:15:17","updated_at":"2026-08-04 11:21:02"},"problem_types":["NVD-CWE-noinfo"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}},{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html","name":"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/74364cb578dcc0b6c9109519d19cbe5a56afac9a","name":"https://git.kernel.org/stable/c/74364cb578dcc0b6c9109519d19cbe5a56afac9a","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/637c00e06564a945e9d0edb3d78d362d64935f9f","name":"https://git.kernel.org/stable/c/637c00e06564a945e9d0edb3d78d362d64935f9f","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/5c9807c523b4fca81d3e8e864dabc8c806402121","name":"https://git.kernel.org/stable/c/5c9807c523b4fca81d3e8e864dabc8c806402121","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/9f9a8f3ac65b4147f1a7b6c05fad5192c0e3c3d9","name":"https://git.kernel.org/stable/c/9f9a8f3ac65b4147f1a7b6c05fad5192c0e3c3d9","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/aac31d654a0a31cb0d2fa36ae694f4e164a52707","name":"https://git.kernel.org/stable/c/aac31d654a0a31cb0d2fa36ae694f4e164a52707","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/5ca60b86f57a4d9648f68418a725b3a7de2816b0","name":"https://git.kernel.org/stable/c/5ca60b86f57a4d9648f68418a725b3a7de2816b0","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html","name":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/96ce4c3537114d1698be635f5e36c62dc49df7a4","name":"https://git.kernel.org/stable/c/96ce4c3537114d1698be635f5e36c62dc49df7a4","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/5c2072f02c0d75802ec28ec703b7d43a0dd008b5","name":"https://git.kernel.org/stable/c/5c2072f02c0d75802ec28ec703b7d43a0dd008b5","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/020f5c53c17f66c0a8f2d37dad27ace301b8d8a1","name":"https://git.kernel.org/stable/c/020f5c53c17f66c0a8f2d37dad27ace301b8d8a1","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-49958","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-49958","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ef962df057aaafd714f5c22ba3de1be459571fdf 5c9807c523b4fca81d3e8e864dabc8c806402121 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ef962df057aaafd714f5c22ba3de1be459571fdf 74364cb578dcc0b6c9109519d19cbe5a56afac9a git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ef962df057aaafd714f5c22ba3de1be459571fdf aac31d654a0a31cb0d2fa36ae694f4e164a52707 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ef962df057aaafd714f5c22ba3de1be459571fdf 020f5c53c17f66c0a8f2d37dad27ace301b8d8a1 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ef962df057aaafd714f5c22ba3de1be459571fdf 5c2072f02c0d75802ec28ec703b7d43a0dd008b5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ef962df057aaafd714f5c22ba3de1be459571fdf 637c00e06564a945e9d0edb3d78d362d64935f9f git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ef962df057aaafd714f5c22ba3de1be459571fdf 9f9a8f3ac65b4147f1a7b6c05fad5192c0e3c3d9 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ef962df057aaafd714f5c22ba3de1be459571fdf 96ce4c3537114d1698be635f5e36c62dc49df7a4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ef962df057aaafd714f5c22ba3de1be459571fdf 5ca60b86f57a4d9648f68418a725b3a7de2816b0 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3a32958d2ac96070c53d04bd8e013c97b260b5e6 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 93f26306db89c9dc37885b76a1082e6d54d23b16 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 26a849f49fb3347d126a0ed6611173f903374ef4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1e7e4c9ae2a78a6791a2ca91a6a400f94855f01e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1926bf8ae44d80c9f50103f11fc4f17e2e2bf684 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.0.87 3.1 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.2.49 3.3 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.4.54 3.5 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.9.11 3.10 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.10.2 3.11 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.11","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 3.11 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.19.323 4.19.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.4.285 5.4.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.227 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.168 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.113 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.55 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.10.14 6.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.11.3 6.11.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2024","cve_id":"49958","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2024-49958","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-10-22T13:35:29.206736Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2024-10-22T13:38:48.118Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"},{"providerMetadata":{"dateUpdated":"2025-11-03T22:23:38.186Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}],"title":"CVE Program Container"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/ocfs2/refcounttree.c","fs/ocfs2/xattr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"5c9807c523b4fca81d3e8e864dabc8c806402121","status":"affected","version":"ef962df057aaafd714f5c22ba3de1be459571fdf","versionType":"git"},{"lessThan":"74364cb578dcc0b6c9109519d19cbe5a56afac9a","status":"affected","version":"ef962df057aaafd714f5c22ba3de1be459571fdf","versionType":"git"},{"lessThan":"aac31d654a0a31cb0d2fa36ae694f4e164a52707","status":"affected","version":"ef962df057aaafd714f5c22ba3de1be459571fdf","versionType":"git"},{"lessThan":"020f5c53c17f66c0a8f2d37dad27ace301b8d8a1","status":"affected","version":"ef962df057aaafd714f5c22ba3de1be459571fdf","versionType":"git"},{"lessThan":"5c2072f02c0d75802ec28ec703b7d43a0dd008b5","status":"affected","version":"ef962df057aaafd714f5c22ba3de1be459571fdf","versionType":"git"},{"lessThan":"637c00e06564a945e9d0edb3d78d362d64935f9f","status":"affected","version":"ef962df057aaafd714f5c22ba3de1be459571fdf","versionType":"git"},{"lessThan":"9f9a8f3ac65b4147f1a7b6c05fad5192c0e3c3d9","status":"affected","version":"ef962df057aaafd714f5c22ba3de1be459571fdf","versionType":"git"},{"lessThan":"96ce4c3537114d1698be635f5e36c62dc49df7a4","status":"affected","version":"ef962df057aaafd714f5c22ba3de1be459571fdf","versionType":"git"},{"lessThan":"5ca60b86f57a4d9648f68418a725b3a7de2816b0","status":"affected","version":"ef962df057aaafd714f5c22ba3de1be459571fdf","versionType":"git"},{"status":"affected","version":"3a32958d2ac96070c53d04bd8e013c97b260b5e6","versionType":"git"},{"status":"affected","version":"93f26306db89c9dc37885b76a1082e6d54d23b16","versionType":"git"},{"status":"affected","version":"26a849f49fb3347d126a0ed6611173f903374ef4","versionType":"git"},{"status":"affected","version":"1e7e4c9ae2a78a6791a2ca91a6a400f94855f01e","versionType":"git"},{"status":"affected","version":"1926bf8ae44d80c9f50103f11fc4f17e2e2bf684","versionType":"git"},{"lessThan":"3.1","status":"affected","version":"3.0.87","versionType":"semver"},{"lessThan":"3.3","status":"affected","version":"3.2.49","versionType":"semver"},{"lessThan":"3.5","status":"affected","version":"3.4.54","versionType":"semver"},{"lessThan":"3.10","status":"affected","version":"3.9.11","versionType":"semver"},{"lessThan":"3.11","status":"affected","version":"3.10.2","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/ocfs2/refcounttree.c","fs/ocfs2/xattr.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.11"},{"lessThan":"3.11","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"4.19.*","status":"unaffected","version":"4.19.323","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.285","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.227","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.168","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.113","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.55","versionType":"semver"},{"lessThanOrEqual":"6.10.*","status":"unaffected","version":"6.10.14","versionType":"semver"},{"lessThanOrEqual":"6.11.*","status":"unaffected","version":"6.11.3","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.12","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.19.323","versionStartIncluding":"3.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.4.285","versionStartIncluding":"3.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.227","versionStartIncluding":"3.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.168","versionStartIncluding":"3.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.113","versionStartIncluding":"3.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.55","versionStartIncluding":"3.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.10.14","versionStartIncluding":"3.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.11.3","versionStartIncluding":"3.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12","versionStartIncluding":"3.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.87","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2.49","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.4.54","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.9.11","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10.2","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: reserve space for inline xattr before attaching reflink tree\n\nOne of our customers reported a crash and a corrupted ocfs2 filesystem. \nThe crash was due to the detection of corruption.  Upon troubleshooting,\nthe fsck -fn output showed the below corruption\n\n[EXTENT_LIST_FREE] Extent list in owner 33080590 claims 230 as the next free chain record,\nbut fsck believes the largest valid value is 227.  Clamp the next record value? n\n\nThe stat output from the debugfs.ocfs2 showed the following corruption\nwhere the \"Next Free Rec:\" had overshot the \"Count:\" in the root metadata\nblock.\n\n        Inode: 33080590   Mode: 0640   Generation: 2619713622 (0x9c25a856)\n        FS Generation: 904309833 (0x35e6ac49)\n        CRC32: 00000000   ECC: 0000\n        Type: Regular   Attr: 0x0   Flags: Valid\n        Dynamic Features: (0x16) HasXattr InlineXattr Refcounted\n        Extended Attributes Block: 0  Extended Attributes Inline Size: 256\n        User: 0 (root)   Group: 0 (root)   Size: 281320357888\n        Links: 1   Clusters: 141738\n        ctime: 0x66911b56 0x316edcb8 -- Fri Jul 12 06:02:30.829349048 2024\n        atime: 0x66911d6b 0x7f7a28d -- Fri Jul 12 06:11:23.133669517 2024\n        mtime: 0x66911b56 0x12ed75d7 -- Fri Jul 12 06:02:30.317552087 2024\n        dtime: 0x0 -- Wed Dec 31 17:00:00 1969\n        Refcount Block: 2777346\n        Last Extblk: 2886943   Orphan Slot: 0\n        Sub Alloc Slot: 0   Sub Alloc Bit: 14\n        Tree Depth: 1   Count: 227   Next Free Rec: 230\n        ## Offset        Clusters       Block#\n        0  0             2310           2776351\n        1  2310          2139           2777375\n        2  4449          1221           2778399\n        3  5670          731            2779423\n        4  6401          566            2780447\n        .......          ....           .......\n        .......          ....           .......\n\nThe issue was in the reflink workfow while reserving space for inline\nxattr.  The problematic function is ocfs2_reflink_xattr_inline().  By the\ntime this function is called the reflink tree is already recreated at the\ndestination inode from the source inode.  At this point, this function\nreserves space for inline xattrs at the destination inode without even\nchecking if there is space at the root metadata block.  It simply reduces\nthe l_count from 243 to 227 thereby making space of 256 bytes for inline\nxattr whereas the inode already has extents beyond this index (in this\ncase up to 230), thereby causing corruption.\n\nThe fix for this is to reserve space for inline metadata at the destination\ninode before the reflink tree gets recreated. The customer has verified the\nfix."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"providerMetadata":{"dateUpdated":"2026-08-04T09:33:57.203Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/5c9807c523b4fca81d3e8e864dabc8c806402121"},{"url":"https://git.kernel.org/stable/c/74364cb578dcc0b6c9109519d19cbe5a56afac9a"},{"url":"https://git.kernel.org/stable/c/aac31d654a0a31cb0d2fa36ae694f4e164a52707"},{"url":"https://git.kernel.org/stable/c/020f5c53c17f66c0a8f2d37dad27ace301b8d8a1"},{"url":"https://git.kernel.org/stable/c/5c2072f02c0d75802ec28ec703b7d43a0dd008b5"},{"url":"https://git.kernel.org/stable/c/637c00e06564a945e9d0edb3d78d362d64935f9f"},{"url":"https://git.kernel.org/stable/c/9f9a8f3ac65b4147f1a7b6c05fad5192c0e3c3d9"},{"url":"https://git.kernel.org/stable/c/96ce4c3537114d1698be635f5e36c62dc49df7a4"},{"url":"https://git.kernel.org/stable/c/5ca60b86f57a4d9648f68418a725b3a7de2816b0"}],"title":"ocfs2: reserve space for inline xattr before attaching reflink tree","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2024-49958","datePublished":"2024-10-21T18:02:11.702Z","dateReserved":"2024-10-21T12:17:06.048Z","dateUpdated":"2026-08-04T09:33:57.203Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2024-10-21 18:15:17","lastModifiedDate":"2026-08-04 11:21:02","problem_types":["NVD-CWE-noinfo"],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-10-22T13:35:29.206736Z","id":"CVE-2024-49958","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.87","versionEndExcluding":"3.2","matchCriteriaId":"791E194E-84AF-4095-87F9-9878CF1FB0CA"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2.49","versionEndExcluding":"3.4","matchCriteriaId":"1439A012-0C0E-4645-BAE0-45B65473BD91"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.4.54","versionEndExcluding":"3.9","matchCriteriaId":"C5906DC6-202A-47B9-B7BA-4EEF64C01726"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.9.11","versionEndExcluding":"3.10","matchCriteriaId":"4BD83880-FDD6-4B9B-977F-BE081DFB3E9A"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.10.2","versionEndExcluding":"3.11","matchCriteriaId":"622187E7-05AC-48EA-B81A-5ACBECB202F5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.11","versionEndExcluding":"5.10.227","matchCriteriaId":"B72C3A38-70DC-4660-8C94-BB0172CE7892"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11","versionEndExcluding":"5.15.168","matchCriteriaId":"4D51C05D-455B-4D8D-89E7-A58E140B864C"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.113","matchCriteriaId":"D01BD22E-ACD1-4618-9D01-6116570BE1EE"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.55","matchCriteriaId":"E90B9576-56C4-47BC-AAB0-C5B2D438F5D0"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.10.14","matchCriteriaId":"4C16BCE0-FFA0-4599-BE0A-1FD65101C021"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.11.3","matchCriteriaId":"54D9C704-D679-41A7-9C40-10A6B1E7FFE9"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2024","CveId":"49958","Ordinal":"1","Title":"ocfs2: reserve space for inline xattr before attaching reflink t","CVE":"CVE-2024-49958","Year":"2024"},"notes":[{"CveYear":"2024","CveId":"49958","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: reserve space for inline xattr before attaching reflink tree\n\nOne of our customers reported a crash and a corrupted ocfs2 filesystem. \nThe crash was due to the detection of corruption.  Upon troubleshooting,\nthe fsck -fn output showed the below corruption\n\n[EXTENT_LIST_FREE] Extent list in owner 33080590 claims 230 as the next free chain record,\nbut fsck believes the largest valid value is 227.  Clamp the next record value? n\n\nThe stat output from the debugfs.ocfs2 showed the following corruption\nwhere the \"Next Free Rec:\" had overshot the \"Count:\" in the root metadata\nblock.\n\n        Inode: 33080590   Mode: 0640   Generation: 2619713622 (0x9c25a856)\n        FS Generation: 904309833 (0x35e6ac49)\n        CRC32: 00000000   ECC: 0000\n        Type: Regular   Attr: 0x0   Flags: Valid\n        Dynamic Features: (0x16) HasXattr InlineXattr Refcounted\n        Extended Attributes Block: 0  Extended Attributes Inline Size: 256\n        User: 0 (root)   Group: 0 (root)   Size: 281320357888\n        Links: 1   Clusters: 141738\n        ctime: 0x66911b56 0x316edcb8 -- Fri Jul 12 06:02:30.829349048 2024\n        atime: 0x66911d6b 0x7f7a28d -- Fri Jul 12 06:11:23.133669517 2024\n        mtime: 0x66911b56 0x12ed75d7 -- Fri Jul 12 06:02:30.317552087 2024\n        dtime: 0x0 -- Wed Dec 31 17:00:00 1969\n        Refcount Block: 2777346\n        Last Extblk: 2886943   Orphan Slot: 0\n        Sub Alloc Slot: 0   Sub Alloc Bit: 14\n        Tree Depth: 1   Count: 227   Next Free Rec: 230\n        ## Offset        Clusters       Block#\n        0  0             2310           2776351\n        1  2310          2139           2777375\n        2  4449          1221           2778399\n        3  5670          731            2779423\n        4  6401          566            2780447\n        .......          ....           .......\n        .......          ....           .......\n\nThe issue was in the reflink workfow while reserving space for inline\nxattr.  The problematic function is ocfs2_reflink_xattr_inline().  By the\ntime this function is called the reflink tree is already recreated at the\ndestination inode from the source inode.  At this point, this function\nreserves space for inline xattrs at the destination inode without even\nchecking if there is space at the root metadata block.  It simply reduces\nthe l_count from 243 to 227 thereby making space of 256 bytes for inline\nxattr whereas the inode already has extents beyond this index (in this\ncase up to 230), thereby causing corruption.\n\nThe fix for this is to reserve space for inline metadata at the destination\ninode before the reflink tree gets recreated. The customer has verified the\nfix.","Type":"Description","Title":"ocfs2: reserve space for inline xattr before attaching reflink t"}]}}}