What’s Vulnerable › Vulnerabilities

CVE-2024-56630: ocfs2: free inode when ocfs2_get_init_inode() fails

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-12-27 · updated 2026-06-17
• Weakness: CWE-908

Description

In the Linux kernel, the following vulnerability has been resolved: ocfs2: free inode when ocfs2_get_init_inode() fails syzbot is reporting busy inodes after unmount, for commit 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") forgot to call iput() when new_inode() succeeded and dquot_initialize() failed.

Affected products

• Linux kernel: from 4.3 before 5.4.287; from 5.5 before 5.10.231; from 5.11 before 5.15.174; from 5.16 before 6.1.120; from 6.2 before 6.6.66; from 6.7 before 6.12.5 — fixed in 5.10.231, 5.15.174, 5.4.287, 6.1.120, 6.12.5, 6.6.66

How to fix

Upgrade to a fixed version: Linux kernel 5.10.231, 5.15.174, 5.4.287, 6.1.120. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/03db61c43c8e2729896fda6b9a95c7fb5c875c20
• https://git.kernel.org/stable/c/67c2c6d0564ca05348ba4f8f6eaf7a0713f56c15
• https://git.kernel.org/stable/c/911fcc95b530615b484e8920741fc5e4bc4e684a
• https://git.kernel.org/stable/c/965b5dd1894f4525f38c1b5f99b0106a07dbb5db
• https://git.kernel.org/stable/c/9c19ea59965ebb482e227532f7bbb01792fb028c
• https://git.kernel.org/stable/c/a84d507d3290aca249b44ae992af9e10590cc5f6
• https://git.kernel.org/stable/c/c5327720a4655303ffa3f632d86ee205dd783f32
• https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
• https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html

Get alerted when CVE-2024-56630 or the next vulnerability affects your stack