CVE-2024-53147: exfat: fix out-of-bounds access of directory entries

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-24 · updated 2026-10-30
Weakness: CWE-125

Description

In the Linux kernel, the following vulnerability has been resolved: exfat: fix out-of-bounds access of directory entries In the case of the directory size is greater than or equal to the cluster size, if start_clu becomes an EOF cluster(an invalid cluster) due to file system corruption, then the directory entry where ei->hint_femp.eidx hint is outside the directory, resulting in an out-of-bounds access, which may cause further file system corruption. This commit adds a check for start_clu, if it is an invalid cluster, the file or directory will be treated as empty.

Affected products

Linux kernel: from 5.7 before 6.11.11; from 6.12 before 6.12.2 — fixed in 6.11.11, 6.12.2
Linux: 5.7 — fixed in 6.13

How to fix

Upgrade to a fixed version: Linux kernel 6.11.11, 6.12.2; Linux 6.13. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-53147 or the next vulnerability affects your stack