What’s Vulnerable › Vulnerabilities

CVE-2024-57850: jffs2: Prevent rtime decompress memory corruption

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-01-11 · updated 2026-08-04
• Weakness: CWE-787

Description

In the Linux kernel, the following vulnerability has been resolved: jffs2: Prevent rtime decompress memory corruption The rtime decompression routine does not fully check bounds during the entirety of the decompression pass and can corrupt memory outside the decompression buffer if the compressed data is corrupted. This adds the required check to prevent this failure mode.

Affected products

• Linux kernel: before 5.4.287; from 5.5 before 5.10.231; from 5.11 before 5.15.174; from 5.16 before 6.1.120; from 6.2 before 6.6.66; from 6.7 before 6.12.5 — fixed in 5.10.231, 5.15.174, 5.4.287, 6.1.120, 6.12.5, 6.6.66

How to fix

Upgrade to a fixed version: Linux kernel 5.10.231, 5.15.174, 5.4.287, 6.1.120. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/421f9e9f0fae9f8e721ffa07f22d9765fa1214d5
• https://git.kernel.org/stable/c/47c9a7f81027a78afea9d2e9a54bfd8fabb6b3d0
• https://git.kernel.org/stable/c/6808a1812a3419542223e7fe9e2de577e99e45d1
• https://git.kernel.org/stable/c/bd384b04ad1995441b18fe6c1366d02de8c5d5eb
• https://git.kernel.org/stable/c/dc39b08fcc3831b0bc46add91ba93cd2aab50716
• https://git.kernel.org/stable/c/f6fc251baefc3cdc4f41f2f5a47940d7d4a67332
• https://git.kernel.org/stable/c/fe051552f5078fa02d593847529a3884305a6ffe
• https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
• https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html

Get alerted when CVE-2024-57850 or the next vulnerability affects your stack