{
  "cveId": "CVE-2024-47691",
  "url": "https://patchblox.com/security/cve/CVE-2024-47691",
  "summary": "CVE-2024-47691 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-47691, released October 21, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix to avoid use-after-free in f2fs_stop_g...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  f2fs: fix to avoid use-after-free in f2fs_stop_gc_thread()  syzbot reports a f2fs bug as below:   __dump_stack lib/dump_stack.c:88 [inline]  dump_stack_lvl\u002B0x241/0x360 lib/dump_stack.c:114  print_report\u002B0xe8/0x550 mm/kasan/report.c:491  kasan_report\u002B0x143/0x180 mm/kasan/report.c:601  kasan_check_range\u002B0x282/0x290 mm/kasan/generic.c:189  instrument_atomic_read_write include/linux/instrumented.h:96 [inline]  atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline]  __refcount_add include/linux/refcount.h:184 [inline]  __refcount_inc include/linux/refcount.h:241 [inline]  refcount_inc include/linux/refcount.h:258 [inline]  get_task_struct include/linux/sched/task.h:118 [inline]  kthread_stop\u002B0xca/0x630 kernel/kthread.c:704  f2fs_stop_gc_thread\u002B0x65/0xb0 fs/f2fs/gc.c:210  f2fs_do_shutdown\u002B0x192/0x540 fs/f2fs/file.c:2283  f2fs_ioc_shutdown fs/f2fs/file.c:2325 [inline]  __f2fs_ioctl\u002B0x443a/0xbe60 fs/f2fs/file.c:4325  vfs_ioctl fs/ioctl.c:51 [inline]  __do_sys_ioctl fs/ioctl.c:907 [inline]  __se_sys_ioctl\u002B0xfc/0x170 fs/ioctl.c:893  do_syscall_x64 arch/x86/entry/common.c:52 [inline]  do_syscall_64\u002B0xf3/0x230 arch/x86/entry/common.c:83  entry_SYSCALL_64_after_hwframe\u002B0x77/0x7f  The root cause is below race condition, it may cause use-after-free issue in sbi-\u003Egc_th pointer.  - remount  - f2fs_remount   - f2fs_stop_gc_thread    - kfree(gc_th) \t\t\t\t- f2fs_ioc_shutdown \t\t\t\t - f2fs_do_shutdown \t\t\t\t  - f2fs_stop_gc_thread \t\t\t\t   - kthread_stop(gc_th-\u003Ef2fs_gc_task)    : sbi-\u003Egc_thread = NULL;  We will call f2fs_do_shutdown() in two paths: - for f2fs_ioc_shutdown() path, we should grab sb-\u003Es_umount semaphore for fixing. - for f2fs_shutdown() path, it\u0027s safe since caller has already grabbed sb-\u003Es_umount semaphore.",
  "published": "2024-10-21T12:15:05Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00237,
  "epssPercentile": 0.14842,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.11.2-1",
      "fix": "DEBIAN-CVE-2024-47691",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-47691",
      "released": "2024-10-21T12:15:05Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.11.2-1",
      "fix": "DEBIAN-CVE-2024-47691",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-47691",
      "released": "2024-10-21T12:15:05Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T01:18:40Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}