CVE-2024-49900: jfs: Fix uninit-value access of new_ea in ea_buffer

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-21 · updated 2026-10-15
Weakness: CWE-908

Description

In the Linux kernel, the following vulnerability has been resolved: jfs: Fix uninit-value access of new_ea in ea_buffer syzbot reports that lzo1x_1_do_compress is using uninit-value: ===================================================== BUG: KMSAN: uninit-value in lzo1x_1_do_compress+0x19f9/0x2510 lib/lzo/lzo1x_compress.c:178 ... Uninit was stored to memory at: ea_put fs/jfs/xattr.c:639 [inline] ... Local variable ea_buf created at: __jfs_setxattr+0x5d/0x1ae0 fs/jfs/xattr.c:662 __jfs_xattr_set+0xe6/0x1f0 fs/jfs/xattr.c:934 ===================================================== The reason is ea_buf->new_ea is not initialized properly. Fix this by using memset to empty its content at the beginning in ea_get().

Affected products

Linux kernel: before 5.10.227; from 5.11 before 5.15.168; from 5.16 before 6.1.113; from 6.2 before 6.6.55; from 6.7 before 6.10.14; from 6.11 before 6.11.3 — fixed in 5.10.227, 5.15.168, 6.1.113, 6.10.14, 6.11.3, 6.6.55

How to fix

Upgrade to a fixed version: Linux kernel 5.10.227, 5.15.168, 6.1.113, 6.10.14. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-49900 or the next vulnerability affects your stack