CVE-2024-26972

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability has been resolved in the Linux kernel, specifically in the ubifs symlink function, where a memleak of inode->i link occurs in the error path. This happens when the inode is marked as bad and then iput() is invoked. If inode->i link is initialized by fscrypt encrypt symlink() in an encryption scenario, it won't be freed by the callchain ubifs free inode -> fscrypt free inode in the error handling path. This is because make bad inode() has changed 'inode->i mode' to 'S IFREG'. The vulnerability can be reproduced by injecting an error in ubifs jnl update() when doing a symlink in an encryption scenario.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.