{"id":"CVE-2024-26972","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: ubifs_symlink: Fix memleak of inode-\u003ei_link in error path\n\nFor error handling path in ubifs_symlink(), inode will be marked as\nbad first, then iput() is invoked. If inode-\u003ei_link is initialized by\nfscrypt_encrypt_symlink() in encryption scenario, inode-\u003ei_link won't\nbe freed by callchain ubifs_free_inode -\u003e fscrypt_free_inode in error\nhandling path, because make_bad_inode() has changed 'inode-\u003ei_mode' as\n'S_IFREG'.\nFollowing kmemleak is easy to be reproduced by injecting error in\nubifs_jnl_update() when doing symlink in encryption scenario:\n unreferenced object 0xffff888103da3d98 (size 8):\n  comm \"ln\", pid 1692, jiffies 4294914701 (age 12.045s)\n  backtrace:\n   kmemdup+0x32/0x70\n   __fscrypt_encrypt_symlink+0xed/0x1c0\n   ubifs_symlink+0x210/0x300 [ubifs]\n   vfs_symlink+0x216/0x360\n   do_symlinkat+0x11a/0x190\n   do_syscall_64+0x3b/0xe0\nThere are two ways fixing it:\n 1. Remove make_bad_inode() in error handling path. We can do that\n    because ubifs_evict_inode() will do same processes for good\n    symlink inode and bad symlink inode, for inode-\u003ei_nlink checking\n    is before is_bad_inode().\n 2. Free inode-\u003ei_link before marking inode bad.\nMethod 2 is picked, it has less influence, personally, I think.","modified":"2026-03-11T07:50:24.794018536Z","published":"2024-05-01T06:15:13Z","withdrawn":"2024-12-19T15:50:34.554427Z","related":["SUSE-SU-2024:1644-1","SUSE-SU-2024:1659-1","SUSE-SU-2024:1663-1","SUSE-SU-2024:2135-1","SUSE-SU-2024:2203-1","SUSE-SU-2024:2973-1","SUSE-SU-2025:20008-1","SUSE-SU-2025:20028-1"],"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/3faea7810e2b3e9a9a92ef42d7e5feaeb8ff7133"},{"type":"WEB","url":"https://git.kernel.org/stable/c/62b5ae00c2b835639002ce898ccb5d82c51073ae"},{"type":"WEB","url":"https://git.kernel.org/stable/c/6379b44cdcd67f5f5d986b73953e99700591edfa"},{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-26972"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:11","purl":"pkg:deb/debian/linux?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.103-1","5.10.103-1~bpo10+1","5.10.106-1","5.10.113-1","5.10.120-1","5.10.120-1~bpo10+1","5.10.127-1","5.10.127-2","5.10.127-2~bpo10+1","5.10.136-1","5.10.140-1","5.10.148-1","5.10.149-1","5.10.149-2","5.10.158-1","5.10.158-2","5.10.162-1","5.10.178-1","5.10.178-2","5.10.178-3","5.10.179-1","5.10.179-2","5.10.179-3","5.10.179-4","5.10.179-5","5.10.191-1","5.10.197-1","5.10.205-1","5.10.205-2","5.10.209-1","5.10.209-2","5.10.216-1","5.10.218-1","5.10.221-1","5.10.223-1","5.10.226-1","5.10.46-4","5.10.46-5","5.10.70-1","5.10.70-1~bpo10+1","5.10.84-1","5.10.92-1","5.10.92-1~bpo10+1","5.10.92-2","5.13.12-1~exp1","5.13.9-1~exp1","5.13.9-1~exp2","5.14-1~exp1","5.14-1~exp2","5.14.1-1~exp1","5.14.12-1","5.14.16-1","5.14.2-1~exp1","5.14.3-1~exp1","5.14.6-1","5.14.6-2","5.14.6-3","5.14.9-1","5.14.9-2","5.14.9-2~bpo11+1","5.15-1~exp1","5.15.1-1~exp1","5.15.15-1","5.15.15-2","5.15.15-2~bpo11+1","5.15.2-1~exp1","5.15.3-1","5.15.5-1","5.15.5-2","5.15.5-2~bpo11+1","5.16.10-1","5.16.11-1","5.16.11-1~bpo11+1","5.16.12-1","5.16.12-1~bpo11+1","5.16.14-1","5.16.18-1","5.16.3-1~exp1","5.16.4-1~exp1","5.16.7-1","5.16.7-2","5.16~rc1-1~exp1","5.16~rc3-1~exp1","5.16~rc4-1~exp1","5.16~rc5-1~exp1","5.16~rc6-1~exp1","5.16~rc7-1~exp1","5.16~rc8-1~exp1","5.17.1-1~exp1","5.17.11-1","5.17.3-1","5.17.6-1","5.17~rc3-1~exp1","5.17~rc4-1~exp1","5.17~rc5-1~exp1","5.17~rc6-1~exp1","5.17~rc7-1~exp1","5.17~rc8-1~exp1","5.18-1~exp1","5.18.14-1","5.18.14-1~bpo11+1","5.18.16-1","5.18.16-1~bpo11+1","5.18.2-1","5.18.2-1~bpo11+1","5.18.5-1","5.19-1~exp1","5.19.11-1","5.19.11-1~bpo11+1","5.19.6-1","5.19~rc4-1~exp1","5.19~rc6-1~exp1","6.0-1~exp1","6.0.10-1","6.0.10-2","6.0.12-1","6.0.12-1+alpha","6.0.12-1~bpo11+1","6.0.2-1","6.0.3-1","6.0.3-1~bpo11+1","6.0.5-1","6.0.6-1","6.0.6-2","6.0.7-1","6.0.8-1","6.0~rc7-1~exp1","6.1.1-1~exp1","6.1.1-1~exp2","6.1.106-1","6.1.106-2","6.1.106-3","6.1.11-1","6.1.112-1","6.1.12-1","6.1.12-1~bpo11+1","6.1.15-1","6.1.15-1~bpo11+1","6.1.2-1~exp1","6.1.20-1","6.1.20-1~bpo11+1","6.1.20-2","6.1.20-2~bpo11+1","6.1.25-1","6.1.27-1","6.1.27-1~bpo11+1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.4-1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.7-1","6.1.76-1","6.1.76-1~bpo11+1","6.1.8-1","6.1.8-1+sh4","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1","6.10-1~exp1","6.10.1-1~exp1","6.10.11-1","6.10.11-1~bpo12+1","6.10.12-1","6.10.3-1","6.10.4-1","6.10.6-1","6.10.6-1~bpo12+1","6.10.7-1","6.10.9-1","6.11-1~exp1","6.11.2-1","6.11~rc4-1~exp1","6.11~rc5-1~exp1","6.1~rc3-1~exp1","6.1~rc5-1~exp1","6.1~rc6-1~exp1","6.1~rc7-1~exp1","6.1~rc8-1~exp1","6.3.1-1~exp1","6.3.11-1","6.3.2-1~exp1","6.3.4-1~exp1","6.3.5-1~exp1","6.3.7-1","6.3.7-1~bpo12+1","6.4.1-1~exp1","6.4.11-1","6.4.13-1","6.4.4-1","6.4.4-1~bpo12+1","6.4.4-2","6.4.4-3","6.4.4-3~bpo12+1","6.4~rc6-1~exp1","6.4~rc7-1~exp1","6.5.1-1~exp1","6.5.10-1","6.5.10-1~bpo12+1","6.5.13-1","6.5.3-1","6.5.3-1~bpo12+1","6.5.6-1","6.5.8-1","6.5~rc4-1~exp1","6.5~rc6-1~exp1","6.5~rc7-1~exp1","6.6.11-1","6.6.13-1","6.6.13-1~bpo12+1","6.6.15-1","6.6.15-2","6.6.3-1~exp1","6.6.4-1~exp1","6.6.7-1~exp1","6.6.8-1","6.6.9-1","6.7-1~exp1","6.7.1-1~exp1","6.7.12-1","6.7.12-1~bpo12+1","6.7.4-1~exp1","6.7.7-1","6.7.9-1","6.7.9-2","6.8.11-1","6.8.12-1","6.8.12-1~bpo12+1","6.8.9-1","6.9.10-1","6.9.10-1~bpo12+1","6.9.11-1","6.9.12-1","6.9.2-1~exp1","6.9.7-1","6.9.7-1~bpo12+1","6.9.8-1","6.9.9-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-26972.json"}},{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1","6.10-1~exp1","6.10.1-1~exp1","6.10.11-1","6.10.11-1~bpo12+1","6.10.12-1","6.10.3-1","6.10.4-1","6.10.6-1","6.10.6-1~bpo12+1","6.10.7-1","6.10.9-1","6.11-1~exp1","6.11.2-1","6.11~rc4-1~exp1","6.11~rc5-1~exp1","6.3.1-1~exp1","6.3.11-1","6.3.2-1~exp1","6.3.4-1~exp1","6.3.5-1~exp1","6.3.7-1","6.3.7-1~bpo12+1","6.4.1-1~exp1","6.4.11-1","6.4.13-1","6.4.4-1","6.4.4-1~bpo12+1","6.4.4-2","6.4.4-3","6.4.4-3~bpo12+1","6.4~rc6-1~exp1","6.4~rc7-1~exp1","6.5.1-1~exp1","6.5.10-1","6.5.10-1~bpo12+1","6.5.13-1","6.5.3-1","6.5.3-1~bpo12+1","6.5.6-1","6.5.8-1","6.5~rc4-1~exp1","6.5~rc6-1~exp1","6.5~rc7-1~exp1","6.6.11-1","6.6.13-1","6.6.13-1~bpo12+1","6.6.15-1","6.6.15-2","6.6.3-1~exp1","6.6.4-1~exp1","6.6.7-1~exp1","6.6.8-1","6.6.9-1","6.7-1~exp1","6.7.1-1~exp1","6.7.12-1","6.7.12-1~bpo12+1","6.7.4-1~exp1","6.7.7-1","6.7.9-1","6.7.9-2","6.8.11-1","6.8.12-1","6.8.12-1~bpo12+1","6.8.9-1","6.9.10-1","6.9.10-1~bpo12+1","6.9.11-1","6.9.12-1","6.9.2-1~exp1","6.9.7-1","6.9.7-1~bpo12+1","6.9.8-1","6.9.9-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-26972.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.9-1"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1","6.3.1-1~exp1","6.3.11-1","6.3.2-1~exp1","6.3.4-1~exp1","6.3.5-1~exp1","6.3.7-1","6.3.7-1~bpo12+1","6.4.1-1~exp1","6.4.11-1","6.4.13-1","6.4.4-1","6.4.4-1~bpo12+1","6.4.4-2","6.4.4-3","6.4.4-3~bpo12+1","6.4~rc6-1~exp1","6.4~rc7-1~exp1","6.5.1-1~exp1","6.5.10-1","6.5.10-1~bpo12+1","6.5.13-1","6.5.3-1","6.5.3-1~bpo12+1","6.5.6-1","6.5.8-1","6.5~rc4-1~exp1","6.5~rc6-1~exp1","6.5~rc7-1~exp1","6.6.11-1","6.6.13-1","6.6.13-1~bpo12+1","6.6.15-1","6.6.15-2","6.6.3-1~exp1","6.6.4-1~exp1","6.6.7-1~exp1","6.6.8-1","6.6.9-1","6.7-1~exp1","6.7.1-1~exp1","6.7.12-1","6.7.12-1~bpo12+1","6.7.4-1~exp1","6.7.7-1","6.7.9-1","6.7.9-2"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-26972.json"}}],"schema_version":"1.7.3"}