CVE-2024-40972

In the Linux kernel, the following vulnerability has been resolved: ext4: do not create EA inode under buffer lock ext4_xattr_set_entry() creates new EA inodes while holding buffer lock on the external xattr block. This is problematic as it nests all the allocation locking (which acquires locks on other buffers) under the buffer lock. This can even deadlock when the filesystem is corrupted and e.g. quota file is setup to contain xattr block as data block. Move the allocation of EA inode out of ext4_xattr_set_entry() into the callers.

• CWE-667

• https://git.kernel.org/stable/c/0752e7fb549d90c33b4d4186f11cfd25a556d1ddPatch
• https://git.kernel.org/stable/c/0a46ef234756dca04623b7591e8ebb3440622f0bPatch
• https://git.kernel.org/stable/c/111103907234bffd0a34fba070ad9367de058752Patch
• https://git.kernel.org/stable/c/737fb7853acd5bc8984f6f42e4bfba3334be8ae1Patch
• https://git.kernel.org/stable/c/0a46ef234756dca04623b7591e8ebb3440622f0bPatch
• https://git.kernel.org/stable/c/111103907234bffd0a34fba070ad9367de058752Patch
• https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

Published

Jul 12, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-40967In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-40968In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-40969In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-4097The Cost Calculator Builder plugin for WordPress is vulnerab…7.2
• CVE-2024-40970In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-40971In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-40973In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-40974In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-40975In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-40976In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-40977In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-40978In the Linux kernel, the following vulnerability has been re…7.1