Skip to content
OpenAdvisories
Unscored CVE-2024-26982 EUVD-2024-24244GHSA-8jh7-gcv4-cq6q

Squashfs: check the inode number is not the invalid value of zero

Published May 1, 2024 · Updated Oct 15, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: kernel Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.15 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.4 Package: linux-aws-5.8 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-6.8 Package: linux-aws-fips Package: linux-aws-hwe Package: linux-azure Package: linux-azure-4.15 Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.15 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.4 Package: linux-azure-5.8 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-6.8 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.2 Package: linux-azure-fips Package: linux-bluefield Package: linux-fips Package: linux-gcp Package: linux-gcp-4.15 Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.15 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.4 Package: linux-gcp-5.8 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-fips Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.15 Package: linux-hwe-5.19 Package: linux-hwe-5.4 Package: linux-hwe-5.8 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-5.15 Package: linux-ibm-5.4 Package: linux-intel Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-intel-iotg Package: linux-intel-iotg-5.15 Package: linux-iot Package: linux-kvm Package: linux-lowlatency Package: linux-lowlatency-hwe-5.15 Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-lts-xenial Package: linux-nvidia Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-nvidia-6.8 Package: linux-nvidia-tegra Package: linux-nvidia-tegra-5.15 Package: linux-nvidia-tegra-igx Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.15 Package: linux-oracle-5.3 Package: linux-oracle-5.4 Package: linux-oracle-5.8 Package: linux-oracle-6.5 Package: linux-oracle-6.8 Package: linux-raspi Package: linux-raspi-5.4 Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.15 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.5 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Package: linux-xilinx-zynqmp Platform: Linux Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

Squashfs: check the inode number is not the invalid value of zero

Syskiller has produced an out of bounds access in fill_meta_index().

That out of bounds access is ultimately caused because the inode
has an inode number with the invalid value of zero, which was not checked.

The reason this causes the out of bounds access is due to following
sequence of events:

1. Fill_meta_index() is called to allocate (via empty_meta_index())
and fill a metadata index. It however suffers a data read error
and aborts, invalidating the newly returned empty metadata index.
It does this by setting the inode number of the index to zero,
which means unused (zero is not a valid inode number).

2. When fill_meta_index() is subsequently called again on another
read operation, locate_meta_index() returns the previous index
because it matches the inode number of 0. Because this index
has been returned it is expected to have been filled, and because
it hasn't been, an out of bounds access is performed.

This patch adds a sanity check which checks that the inode number
is not zero when the inode is created and returns -EINVAL if it is.

[phillip@squashfs.org.uk: whitespace fix]

Affected products

VendorProductAffectedFixed
Linux Linux 2.6.29 5.4.291

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.8.9-1 —
Debian 13 linux 6.8.9-1 —
Debian 12 linux 6.1.133-1 DSA-5900-1
Debian 11 linux 5.10.237-1 DLA-4178-1
Debian 11 linux-6.1 6.1.137-1~deb11u1 DLA-4193-1
ReleasePackageFixed inAdvisory
Ubuntu Nvidia-BlueField 22.04 LTS linux-bluefield 5.15.0-1066.68 —
Ubuntu 24.04 LTS linux 6.8.0-38.38 USN-6893-1
Ubuntu 24.04 LTS linux-aws 6.8.0-1011.12 USN-6893-3
Ubuntu 24.04 LTS linux-azure 6.8.0-1010.10 USN-6893-1
Ubuntu 24.04 LTS linux-gcp 6.8.0-1010.11 USN-6893-1
Ubuntu 24.04 LTS linux-gke 6.8.0-1006.9 USN-6893-2
Ubuntu 24.04 LTS linux-ibm +2 6.8.0-1008.8 USN-6918-1, USN-6893-1
Ubuntu 24.04 LTS linux-intel 6.8.0-1007.14 USN-6893-1
Ubuntu 24.04 LTS linux-nvidia 6.8.0-1009.9 USN-6893-2
Ubuntu 24.04 LTS linux-raspi 6.8.0-1007.7 USN-6893-1
Ubuntu 24.04 LTS linux-riscv +1 6.8.0-38.38.1 USN-6893-1
Ubuntu 22.04 LTS linux +1 5.15.0-140.150 USN-7510-1
Ubuntu 22.04 LTS linux-aws 5.15.0-1084.91 USN-7510-7
Ubuntu 22.04 LTS linux-aws-6.8 6.8.0-1011.12~22.04.1 —
Ubuntu 22.04 LTS linux-azure 5.15.0-1089.98 USN-7510-3
Ubuntu 22.04 LTS linux-azure-6.8 6.8.0-1010.10~22.04.1 —
Ubuntu 22.04 LTS linux-azure-fde 5.15.0-1089.98.1 —
Ubuntu 22.04 LTS linux-gcp 5.15.0-1083.92 USN-7511-1
Ubuntu 22.04 LTS linux-gke +1 5.15.0-1081.87 USN-7511-3, USN-7510-1
Ubuntu 22.04 LTS linux-gkeop 5.15.0-1066.74 USN-7510-1
Ubuntu 22.04 LTS linux-ibm 5.15.0-1076.79 USN-7510-1
Ubuntu 22.04 LTS linux-intel-iotg 5.15.0-1079.85 USN-7510-1
Ubuntu 22.04 LTS linux-kvm 5.15.0-1080.85 USN-7510-1
Ubuntu 22.04 LTS linux-nvidia 5.15.0-1078.79 USN-7510-1
Ubuntu 22.04 LTS linux-nvidia-6.8 6.8.0-1009.9~22.04.1 —
Ubuntu 22.04 LTS linux-nvidia-tegra 5.15.0-1037.37 USN-7510-3
Ubuntu 22.04 LTS linux-nvidia-tegra-igx 5.15.0-1026.26 USN-7510-7
Ubuntu 22.04 LTS linux-oracle-6.8 6.8.0-1008.8~22.04.1 —
Ubuntu 22.04 LTS linux-raspi 5.15.0-1078.81 USN-7510-7
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 22.04 LTS linux-xilinx-zynqmp 5.15.0-1050.54 USN-7602-1
Ubuntu 20.04 LTS linux 5.4.0-216.236 USN-7516-1
Ubuntu 20.04 LTS linux-aws 5.4.0-1146.156 USN-7516-9
Ubuntu 20.04 LTS linux-aws-5.15 5.15.0-1084.91~20.04.1 USN-7510-8
Ubuntu 20.04 LTS linux-azure 5.4.0-1151.158 USN-7516-3
Ubuntu 20.04 LTS linux-azure-5.15 5.15.0-1089.98~20.04.1 USN-7510-3
Ubuntu 20.04 LTS linux-bluefield 5.4.0-1105.112 USN-7517-3
Ubuntu 20.04 LTS linux-gcp 5.4.0-1149.158 USN-7516-1
Ubuntu 20.04 LTS linux-gcp-5.15 5.15.0-1083.92~20.04.1 USN-7512-1
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 20.04 LTS linux-ibm 5.4.0-1092.97 USN-7516-6
Ubuntu 20.04 LTS linux-ibm-5.15 5.15.0-1076.79~20.04.1 USN-7510-1
Ubuntu 20.04 LTS linux-intel-iotg-5.15 5.15.0-1079.85~20.04.1 USN-7510-7
Ubuntu 20.04 LTS linux-kvm 5.4.0-1133.142 USN-7516-3
Ubuntu 20.04 LTS linux-lowlatency-hwe-5.15 5.15.0-140.150~20.04.1 USN-7510-1
Ubuntu 20.04 LTS linux-oracle 5.4.0-1144.154 USN-7516-1
Ubuntu 20.04 LTS linux-oracle-5.15 5.15.0-1081.87~20.04.1 USN-7510-1
Ubuntu 20.04 LTS linux-raspi 5.4.0-1129.142 USN-7539-1
Ubuntu 20.04 LTS linux-riscv-5.15 5.15.0-1079.83~20.04.1 —
Ubuntu 20.04 LTS linux-xilinx-zynqmp 5.4.0-1064.68 USN-7517-1
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Show 15 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Ubuntu Pro Realtime 24.04 LTS linux-raspi-realtime 6.8.0-2006.6 —
Ubuntu Pro Realtime 24.04 LTS linux-realtime 6.8.1-1004.4 —
Ubuntu Pro Realtime 22.04 LTS linux-intel-iot-realtime 5.15.0-1077.79 USN-7510-4
Ubuntu Pro Realtime 22.04 LTS linux-realtime 5.15.0-1084.93 USN-7510-4
Ubuntu Pro FIPS 20.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS 18.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS 16.04 LTS linux-fips No fix yet —
Ubuntu Pro FIPS-updates 22.04 LTS linux-aws-fips 5.15.0-1084.91+fips1 USN-7510-6
Ubuntu Pro FIPS-updates 22.04 LTS linux-azure-fips 5.15.0-1089.98+fips1 USN-7510-5
Ubuntu Pro FIPS-updates 22.04 LTS linux-fips 5.15.0-140.150+fips1 USN-7510-2
Ubuntu Pro FIPS-updates 22.04 LTS linux-gcp-fips 5.15.0-1083.92+fips1 USN-7511-2
Ubuntu Pro FIPS-updates 20.04 LTS linux-aws-fips 5.4.0-1146.156+fips1 USN-7516-8
Ubuntu Pro FIPS-updates 20.04 LTS linux-azure-fips 5.4.0-1151.158+fips1 USN-7518-1
Ubuntu Pro FIPS-updates 20.04 LTS linux-fips 5.4.0-1120.130 USN-7516-8
Ubuntu Pro FIPS-updates 20.04 LTS linux-gcp-fips 5.4.0-1149.158+fips1 USN-7516-2
Ubuntu Pro FIPS-updates 18.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS-updates 16.04 LTS linux-fips No fix yet —
Ubuntu Pro FIPS-preview 22.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro 20.04 LTS linux-hwe-5.15 5.15.0-142.152~20.04.1 USN-7593-1
Ubuntu Pro 20.04 LTS linux-iot 5.4.0-1051.54 USN-7640-1
Ubuntu Pro 20.04 LTS linux-nvidia-tegra-5.15 5.15.0-1039.39~20.04.1 —
Ubuntu Pro 18.04 LTS linux +5 No fix yet —
Ubuntu Pro 18.04 LTS linux-aws-5.4 5.4.0-1146.156~18.04.1 USN-7516-7
Ubuntu Pro 18.04 LTS linux-azure-5.4 5.4.0-1151.158~18.04.1 USN-7516-1
Ubuntu Pro 18.04 LTS linux-gcp-5.4 5.4.0-1149.158~18.04.1 USN-7516-1
Ubuntu Pro 18.04 LTS linux-hwe-5.4 5.4.0-216.236~18.04.1 USN-7516-5
Ubuntu Pro 18.04 LTS linux-ibm-5.4 5.4.0-1092.97~18.04.1 USN-7517-2
Ubuntu Pro 18.04 LTS linux-oracle-5.4 5.4.0-1144.154~18.04.1 USN-7516-4
Ubuntu Pro 18.04 LTS linux-raspi-5.4 5.4.0-1129.142~18.04.1 USN-7540-1
Ubuntu Pro 16.04 LTS linux +7 No fix yet —
Ubuntu Pro 14.04 LTS linux +3 No fix yet —
ReleasePackageFixed inAdvisory
RHEL 9 bpftool 7.3.0-427.28.1.el9_4 RHSA-2024:4928
RHEL 9 rv +64 5.14.0-427.28.1.el9_4 RHSA-2024:4928
RHEL 8 kernel-rt +12 4.18.0-553.8.1.rt7.349.el8_10 RHSA-2024:4352
RHEL 8 perf +26 4.18.0-553.8.1.el8_10 RHSA-2024:4211
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.2 EUS bpftool 7.0.0-284.75.1.el9_2 RHSA-2024:4823
RHEL 9.2 EUS kernel-rt +14 5.14.0-284.75.1.rt14.360.el9_2 RHSA-2024:4831
RHEL 9.2 EUS perf +48 5.14.0-284.75.1.el9_2 RHSA-2024:4823
RHEL 8.8 EUS perf +26 4.18.0-477.67.1.el8_8 RHSA-2024:5255
RHEL 8.6 TUS perf +16 4.18.0-372.121.1.el8_6 RHSA-2024:6297
RHEL 8.6 E4S perf +24 4.18.0-372.121.1.el8_6 RHSA-2024:6297
RHEL 8.6 AUS perf +16 4.18.0-372.121.1.el8_6 RHSA-2024:6297

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 9 bpftool 7.3.0-427.28.1.el9_4 ALSA-2024:4928
AlmaLinux 9 rv +60 5.14.0-427.28.1.el9_4 ALSA-2024:4928
AlmaLinux 8 kernel-rt +11 4.18.0-553.8.1.rt7.349.el8_10 ALSA-2024:4352
AlmaLinux 8 perf +24 4.18.0-553.8.1.el8_10 ALSA-2024:4211

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 9 kernel 5.14.0-427.28.1.el9_4 RXSA-2024:4928, RLSA-2024:4928
Rocky Linux 8 kernel 4.18.0-553.8.1.el8_10 RLSA-2024:4211
Rocky Linux 8 kernel-rt 4.18.0-553.8.1.rt7.349.el8_10 RLSA-2024:4352
ReleasePackageFixed inAdvisory
SLES 15 SP6 kernel-64kb +3 6.4.0-150600.23.7.3 SUSE-SU-2024:2203-1
SLES 15 SP6 kernel-azure +1 6.4.0-150600.8.5.4 SUSE-SU-2024:2135-1
SLES 15 SP6 kernel-default-base 6.4.0-150600.23.7.3.150600.12.2.7 SUSE-SU-2024:2203-1
SLES 15 SP6 kernel-docs 6.4.0-150600.23.7.4 SUSE-SU-2024:2203-1
SLES 15 SP6 kernel-source 6.4.0-150600.23.7.2 SUSE-SU-2024:2203-1
SLES 15 SP6 kernel-syms 6.4.0-150600.23.7.1 SUSE-SU-2024:2203-1
SLES 15 SP6 kernel-syms-azure 6.4.0-150600.8.5.1 SUSE-SU-2024:2135-1
SLES 15 SP5 kernel-64kb +5 5.14.21-150500.55.62.2 SUSE-SU-2024:1659-1
SLES 15 SP5 kernel-azure +2 5.14.21-150500.33.51.1 SUSE-SU-2024:1644-1
SLES 15 SP5 kernel-default-base 5.14.21-150500.55.62.2.150500.6.27.2 SUSE-SU-2024:1659-1
SLES 15 SP5 kernel-syms 5.14.21-150500.55.62.1 SUSE-SU-2024:1659-1
SLES 12 SP5 kernel-syms +2 4.12.14-122.269.1 SUSE-SU-2025:02846-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 6.0 kernel-default-base 6.4.0-17.1.1.51 SUSE-SU-2025:20008-1
SLE Micro 6.0 kernel-rt +1 6.4.0-9.1 SUSE-SU-2025:20028-1
SLE Micro 6.0 kernel-source +2 6.4.0-18.1 SUSE-SU-2025:20008-1
SLE Micro 5.5 kernel-default 5.14.21-150500.55.62.2 SUSE-SU-2024:1659-1
SLE Micro 5.5 kernel-default-base 5.14.21-150500.55.62.2.150500.6.27.2 SUSE-SU-2024:1659-1
SLE Micro 5.5 kernel-rt +1 5.14.21-150500.13.52.1 SUSE-SU-2024:1663-1
SLE Live Patching 15 SP6 kernel-default 6.4.0-150600.23.7.3 SUSE-SU-2024:2203-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6-RT_Update_1 1-150600.1.5.1 SUSE-SU-2024:2973-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_1 1-150600.13.3.7 SUSE-SU-2024:2203-1
SLE Live Patching 15 SP5 kernel-default 5.14.21-150500.55.62.2 SUSE-SU-2024:1659-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5-RT_Update_14 1-150500.11.5.1 SUSE-SU-2024:1663-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_13 1-150500.11.3.2 SUSE-SU-2024:1659-1
SLE Live Patching 12 SP5 kernel-default 4.12.14-122.269.1 SUSE-SU-2025:02846-1
SLE Live Patching 12 SP5 kgraft-patch-SLE12-SP5_Update_71 1-8.3.1 SUSE-SU-2025:02846-1
SUSE Real Time Module 15 SP6 kernel-rt +3 6.4.0-150600.10.5.1 SUSE-SU-2024:2973-1
SUSE Real Time Module 15 SP5 kernel-rt +3 5.14.21-150500.13.52.1 SUSE-SU-2024:1663-1
ReleasePackageFixed inAdvisory
openSUSE Leap 15.6 dtb-aarch64 +2 6.4.0-150600.23.7.1 SUSE-SU-2024:2203-1
openSUSE Leap 15.6 kernel-64kb +5 6.4.0-150600.23.7.3 SUSE-SU-2024:2203-1
openSUSE Leap 15.6 kernel-azure +1 6.4.0-150600.8.5.4 SUSE-SU-2024:2135-1
openSUSE Leap 15.6 kernel-default-base 6.4.0-150600.23.7.3.150600.12.2.7 SUSE-SU-2024:2203-1
openSUSE Leap 15.6 kernel-docs 6.4.0-150600.23.7.4 SUSE-SU-2024:2203-1
openSUSE Leap 15.6 kernel-rt +3 6.4.0-150600.10.5.1 SUSE-SU-2024:2973-1
openSUSE Leap 15.6 kernel-source 6.4.0-150600.23.7.2 SUSE-SU-2024:2203-1
openSUSE Leap 15.6 kernel-syms-azure 6.4.0-150600.8.5.1 SUSE-SU-2024:2135-1
openSUSE Leap 15.5 dtb-aarch64 +2 5.14.21-150500.55.62.1 SUSE-SU-2024:1659-1
openSUSE Leap 15.5 kernel-64kb +7 5.14.21-150500.55.62.2 SUSE-SU-2024:1659-1
openSUSE Leap 15.5 kernel-azure +2 5.14.21-150500.33.51.1 SUSE-SU-2024:1644-1
openSUSE Leap 15.5 kernel-default-base 5.14.21-150500.55.62.2.150500.6.27.2 SUSE-SU-2024:1659-1
openSUSE Leap 15.5 kernel-rt +3 5.14.21-150500.13.52.1 SUSE-SU-2024:1663-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 kernel-livepatch-6.1.131-143.221 1.0-0.amzn2023 ALAS2023-2025-915
Amazon Linux 2023 perf +14 6.1.131-143.221.amzn2023 ALAS2023-2025-915

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 2 (CBL-Mariner) kernel 5.15.179.1-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 bpftool 7.3.0-427.28.1.el9_4 ELSA-2024-4928
Oracle Linux 9 rv +27 5.14.0-427.28.1.el9_4 ELSA-2024-4928
Oracle Linux 8 perf +19 4.18.0-553.8.1.el8_10 ELSA-2024-4211

Advisories 50

References