CVE-2024-26689

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-26689
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26689.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-26689
Downstream
Related
Published
2024-04-03T14:54:50.885Z
Modified
2026-03-14T12:27:40.097462Z
Summary
ceph: prevent use-after-free in encode_cap_msg()
Details

In the Linux kernel, the following vulnerability has been resolved:

ceph: prevent use-after-free in encodecapmsg()

In fs/ceph/caps.c, in encodecapmsg(), "use after free" error was caught by KASAN at this line - 'cephbufferget(arg->xattr_buf);'. This implies before the refcount could be increment here, it was freed.

In same file, in "handlecapgrant()" refcount is decremented by this line - 'cephbufferput(ci->i_xattrs.blob);'. It appears that a race occurred and resource was freed by the latter line before the former line could increment it.

encodecapmsg() is called by __send_cap() and __sendcap() is called by cephcheck_caps() after calling __prep_cap(). _prepcap() is where arg->xattrbuf is assigned to ci->ixattrs.blob. This is the spot where the refcount must be increased to prevent "use after free" error.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/26xxx/CVE-2024-26689.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
9030aaf9bf0a1eee47a154c316c789e959638b0f
Fixed
8180d0c27b93a6eb60da1b08ea079e3926328214
Fixed
70e329b440762390258a6fe8c0de93c9fdd56c77
Fixed
f3f98d7d84b31828004545e29fd7262b9f444139
Fixed
ae20db45e482303a20e56f2db667a9d9c54ac7e7
Fixed
7958c1bf5b03c6f1f58e724dbdec93f8f60b96fc
Fixed
cda4672da1c26835dcbd7aec2bfed954eda9b5ef

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-26689.json"