CVE-2024-26878: quota: Fix potential NULL pointer dereference

Severity: medium (CVSS 4.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-17 · updated 2026-10-15
Weakness: CWE-362

Description

In the Linux kernel, the following vulnerability has been resolved: quota: Fix potential NULL pointer dereference Below race may cause NULL pointer dereference P1 P2 dquot_free_inode quota_off drop_dquot_ref remove_dquot_ref dquots = i_dquot(inode) dquots = i_dquot(inode) srcu_read_lock dquots[cnt]) != NULL (1) dquots[type] = NULL (2) spin_lock(&dquots[cnt]->dq_dqb_lock) (3) .... If dquot_free_inode(or other routines) checks inode's quota pointers (1) before quota_off sets it to NULL(2) and use it (3) after that, NULL pointer dereference will be triggered. So let's fix it by using a temporary pointer to avoid this issue.

Affected products

Debian Linux: 10.0
Linux kernel: before 4.19.311; from 4.20 before 5.4.273; from 5.5 before 5.10.214; from 5.11 before 5.15.153; from 5.16 before 6.1.83; from 6.2 before 6.6.23 — fixed in 4.19.311, 5.10.214, 5.15.153, 5.4.273, 6.1.83, 6.6.23

How to fix

Upgrade to a fixed version: Linux kernel 4.19.311, 5.10.214, 5.15.153, 5.4.273. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-26878 or the next vulnerability affects your stack