CVE-2024-50006: linux kernel — Fix

Description

In the Linux kernel, the following vulnerability has been resolved: ext4: fix i_data_sem unlock order in ext4_ind_migrate() Fuzzing reports a possible deadlock in jbd2_log_wait_commit. This issue is triggered when an EXT4_IOC_MIGRATE ioctl is set to require synchronous updates because the file descriptor is opened with O_SYNC. This can lead to the jbd2_journal_stop() function calling jbd2_might_wait_for_commit(), potentially causing a deadlock if the EXT4_IOC_MIGRATE call races with a write(2) system call. This problem only arises when CONFIG_PROVE_LOCKING is enabled. In this case, the jbd2_might_wait_for_commit macro locks jbd2_handle in the jbd2_journal_stop function while i_data_sem is locked. This triggers lockdep because the jbd2_journal_start function might also lock the same jbd2_handle simultaneously. Found by Linux Verification Center (linuxtesting.org) with syzkaller. Rule: add

Is your site exposed to CVE-2024-50006?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

4.7

MEDIUM

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-667 CWE-667

Affected Products

Vendor	Product	Versions
linux	linux_kernel	< 5.10.227
linux	linux_kernel	5.11 — 5.15.168
linux	linux_kernel	5.16 — 6.1.113
linux	linux_kernel	6.2 — 6.6.55
linux	linux_kernel	6.7 — 6.10.14
linux	linux_kernel	6.11 — 6.11.3

References

Advisories & Patches

https://git.kernel.org/stable/c/53b1999cfd2c7addf2e581a32865fe8835467b44 https://git.kernel.org/stable/c/6252cb6bde7fc76cb8dcb49d1def7c326b190820 https://git.kernel.org/stable/c/9fedf51ab8cf7b69bff08f37fe0989fec7f5d870 https://git.kernel.org/stable/c/cc749e61c011c255d81b192a822db650c68b313f https://git.kernel.org/stable/c/d43776b907659affef1de888525847d64b244194 https://git.kernel.org/stable/c/d58a00e981d3118b91d503da263e640b7cde6729 https://git.kernel.org/stable/c/ef05572da0c0eb89614ed01cc17d3c882bdbd1ff

Other References

https://git.kernel.org/stable/c/3c46d6060d3e38de22196c1fe7706c5a3c696285 https://git.kernel.org/stable/c/4192adefc9c570698821c5eb9873320eac2fcbf1 https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html https://cert-portal.siemens.com/productcert/html/ssa-265688.html https://cert-portal.siemens.com/productcert/html/ssa-355557.html https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Frequently Asked Questions

What is CVE-2024-50006? +

In the Linux kernel, the following vulnerability has been resolved: ext4: fix i_data_sem unlock order in ext4_ind_migrate() Fuzzing reports a possible deadlock in jbd2_log_wait_commit. This issue is triggered when an EXT4_IOC_MIGRATE ioctl is set to require synchronous updates because the file descriptor is opened with O_SYNC. This can lead to the jbd2_journal_stop() function calling jbd2_might_wait_for_commit(), potentially causing a deadlock if the EXT4_IOC_MIGRATE call races with a write(2) system call. This problem only arises when CONFIG_PROVE_LOCKING is enabled. In this case, the jbd2_might_wait_for_commit macro locks jbd2_handle in the jbd2_journal_stop function while i_data_sem is locked. This triggers lockdep because the jbd2_journal_start function might also lock the same jbd2_handle simultaneously. Found by Linux Verification Center (linuxtesting.org) with syzkaller. Rule: add It has a CVSS v3.1 base score of 4.7 (MEDIUM).

How severe is CVE-2024-50006? +

CVE-2024-50006 has a CVSS v3.1 score of 4.7 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-50006? +

CVE-2024-50006 affects products from linux, specifically: linux_kernel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-50006? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-1221

A Zigbee Radio Co-Processor (RCP), which is using SiLabs EmberZNet Zigbee stack, was unable to send messages to the host …

CVE-2025-10151

Improper locking vulnerability in Softing Industrial Automation GmbH gateways allows infected memory and/or resource leak exposure.This issue affects smartLink HW-PN: …

CVE-2026-54906 9.8

concurrent-ruby is a modern concurrency tools for Ruby. Prior to 1.3.7, Concurrent::ReadWriteLock#release_write_lock does not verify that the calling thread acquired …

CVE-2026-43215 8.8

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix locking usage for tcon fields We used to …

CVE-2026-31629 8.8

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: add missing return after LLCP_CLOSED checks In nfc_llcp_recv_hdlc() …

CVE-2026-62426 8.8

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] To manage the …

CVE-2024-50006