{
  "cveId": "CVE-2024-49880",
  "url": "https://patchblox.com/security/cve/CVE-2024-49880",
  "summary": "CVE-2024-49880 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-49880, released October 21, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  ext4: fix off by one issue in alloc_flex_gd()  W...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  ext4: fix off by one issue in alloc_flex_gd()  Wesley reported an issue:  ================================================================== EXT4-fs (dm-5): resizing filesystem from 7168 to 786432 blocks ------------[ cut here ]------------ kernel BUG at fs/ext4/resize.c:324! CPU: 9 UID: 0 PID: 3576 Comm: resize2fs Not tainted 6.11.0\u002B #27 RIP: 0010:ext4_resize_fs\u002B0x1212/0x12d0 Call Trace:  __ext4_ioctl\u002B0x4e0/0x1800  ext4_ioctl\u002B0x12/0x20  __x64_sys_ioctl\u002B0x99/0xd0  x64_sys_call\u002B0x1206/0x20d0  do_syscall_64\u002B0x72/0x110  entry_SYSCALL_64_after_hwframe\u002B0x76/0x7e ==================================================================  While reviewing the patch, Honza found that when adjusting resize_bg in alloc_flex_gd(), it was possible for flex_gd-\u003Eresize_bg to be bigger than flexbg_size.  The reproduction of the problem requires the following:   o_group = flexbg_size * 2 * n;  o_size = (o_group \u002B 1) * group_size;  n_group: [o_group \u002B flexbg_size, o_group \u002B flexbg_size * 2)  o_size = (n_group \u002B 1) * group_size;  Take n=0,flexbg_size=16 as an example:                last:15 |o---------------|--------------n-| o_group:0    resize to      n_group:30  The corresponding reproducer is:  img=test.img rm -f $img truncate -s 600M $img mkfs.ext4 -F $img -b 1024 -G 16 8M dev=\u0060losetup -f --show $img\u0060 mkdir -p /tmp/test mount $dev /tmp/test resize2fs $dev 248M  Delete the problematic plus 1 to fix the issue, and add a WARN_ON_ONCE() to prevent the issue from happening again.  [ Note: another reproucer which this commit fixes is:    img=test.img   rm -f $img   truncate -s 25MiB $img   mkfs.ext4 -b 4096 -E nodiscard,lazy_itable_init=0,lazy_journal_init=0 $img   truncate -s 3GiB $img   dev=\u0060losetup -f --show $img\u0060   mkdir -p /tmp/test   mount $dev /tmp/test   resize2fs $dev 3G   umount $dev   losetup -d $dev    -- TYT ]",
  "published": "2024-10-21T18:15:10Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00244,
  "epssPercentile": 0.1569,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.11.4-1",
      "fix": "DEBIAN-CVE-2024-49880",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-49880",
      "released": "2024-10-21T18:15:10Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.11.4-1",
      "fix": "DEBIAN-CVE-2024-49880",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-49880",
      "released": "2024-10-21T18:15:10Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}