{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-38626", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-18T19:36:34.945Z", "datePublished": "2024-06-21T10:18:18.255Z", "dateUpdated": "2026-08-05T11:33:15.652Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:33:15.652Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfuse: clear FR_SENT when re-adding requests into pending list\n\nThe following warning was reported by lee bruce:\n\n ------------[ cut here ]------------\n WARNING: CPU: 0 PID: 8264 at fs/fuse/dev.c:300\n fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300\n Modules linked in:\n CPU: 0 PID: 8264 Comm: ab2 Not tainted 6.9.0-rc7\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\n RIP: 0010:fuse_request_end+0x685/0x7e0 fs/fuse/dev.c:300\n ......\n Call Trace:\n \n fuse_dev_do_read.constprop.0+0xd36/0x1dd0 fs/fuse/dev.c:1334\n fuse_dev_read+0x166/0x200 fs/fuse/dev.c:1367\n call_read_iter include/linux/fs.h:2104 [inline]\n new_sync_read fs/read_write.c:395 [inline]\n vfs_read+0x85b/0xba0 fs/read_write.c:476\n ksys_read+0x12f/0x260 fs/read_write.c:619\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xce/0x260 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n ......\n \n\nThe warning is due to the FUSE_NOTIFY_RESEND notify sent by the write()\nsyscall in the reproducer program and it happens as follows:\n\n(1) calls fuse_dev_read() to read the INIT request\nThe read succeeds. During the read, bit FR_SENT will be set on the\nrequest.\n(2) calls fuse_dev_write() to send an USE_NOTIFY_RESEND notify\nThe resend notify will resend all processing requests, so the INIT\nrequest is moved from processing list to pending list again.\n(3) calls fuse_dev_read() with an invalid output address\nfuse_dev_read() will try to copy the same INIT request to the output\naddress, but it will fail due to the invalid address, so the INIT\nrequest is ended and triggers the warning in fuse_request_end().\n\nFix it by clearing FR_SENT when re-adding requests into pending list." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - Exploitation requires local syscalls only — opening /dev/fuse, mounting a FUSE filesystem, and issuing read()/write() on the device fd to deliver FUSE_NOTIFY_RESEND. There is no network-facing path into fuse_resend().\nAC:L - The trigger is a deterministic syscall sequence (read request → write FUSE_NOTIFY_RESEND → read into a faulting buffer, or signal the waiter), all driven from the attacker's own process with no race or memory-layout condition outside their control.\nPR:L - An unprivileged local user suffices: fuse is registered with FS_USERNS_MOUNT so the filesystem can be mounted inside `unshare -Urm`, and /dev/fuse is world-accessible on stock distributions (with setuid fusermount3 as an alternative). No real root or init-namespace capability is needed.\nUI:N - The attacking process acts as both the FUSE daemon and the requester thread, performing every step itself. No victim action is required.\nS:U - The corruption is confined to kernel FUSE request objects and queues within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Losing the FR_SENT/FR_PENDING invariant lets a fuse_req be freed while still linked on fiq->interrupts, and the subsequent read of that dangling entry exposes reallocated slab contents to the attacker-controlled daemon; the WARN splat additionally dumps kernel addresses and register state.\nI:H - The use-after-free on the fiq->interrupts list yields a list-unlink write into memory the attacker can groom by reclaiming the freed fuse_req slab object, a standard route to arbitrary write and control-flow hijack.\nA:H - The documented outcome is a WARNING at fs/fuse/dev.c:300, which panics the machine when panic_on_warn is set, and the underlying use-after-free/list corruption causes oopses; an unprivileged user can trigger it repeatedly at will." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/fuse/dev.c" ], "versions": [ { "version": "760eac73f9f69aa28fcb3050b4946c2dcc656d12", "lessThan": "533070db659a9589310a743e9de14cf9d651ffaf", "status": "affected", "versionType": "git" }, { "version": "760eac73f9f69aa28fcb3050b4946c2dcc656d12", "lessThan": "246014876d782bbf2e652267482cd2e799fb5fcd", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/fuse/dev.c" ], "versions": [ { "version": "6.9", "status": "affected" }, { "version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver" }, { "version": "6.9.4", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.9.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/533070db659a9589310a743e9de14cf9d651ffaf" }, { "url": "https://git.kernel.org/stable/c/246014876d782bbf2e652267482cd2e799fb5fcd" } ], "title": "fuse: clear FR_SENT when re-adding requests into pending list", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T04:12:26.061Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/533070db659a9589310a743e9de14cf9d651ffaf", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/246014876d782bbf2e652267482cd2e799fb5fcd", "tags": [ "x_transferred" ] } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-38626", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T17:09:09.210005Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:44.692Z" } } ] } }