CVE-2024-26704

Summary

CVE-2024-26704 is a vulnerability in the Linux kernel that affects the ext4 file system. In the function ext4_move_extents(), a double-free issue occurs when the moved extents overlap with preallocated extents. This happens because moved_len, which is used to determine whether to discard preallocated blocks, is not updated when the loop fails to exit after successfully moving some extents. As a result, these blocks are freed twice, leading to a zero-division bug in mb_update_avg_fragment_size() when trim is executed. To prevent this issue, the Linux kernel team has recommended updating move_len after each extent move.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.