High 7.1Published Jun 25, 2024

CVE-2024-39469nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors

Updated under an hour ago (Oct 28, 2026, 11:00 AM ET)

Does this affect you?

It affects Linux and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix nilfs_empty_dir() misjudgment and long loop on I/O errors The error handling in nilfs_empty_dir() when a directory folio/page read fails is incorrect, as in the old ext2 implementation, and if the folio/page cannot be read or nilfs_check_folio() fails, it will falsely determine the directory as empty and corrupt the file system. In addition, since nilfs_empty_dir() does not immediately return on a failed folio/page read, but continues to loop, this can cause a long loop with I/O if i_size of the directory's inode is also corrupted, causing the log writer thread to wait and hang, as reported by syzbot. Fix these issues by making nilfs_empty_dir() immediately return a false value (0) if it fails to get a directory folio/page.

CVSS: 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	2ba466d74ed74f073257f86e61519cb8f8f46184 builds before 2ac8a2fe22bdde9eecce2a42cf5cab79333fb428; from 2ba466d74ed74f073257f86e61519cb8f8f46184 before 405b71f1251e5ae865f53bd27c45114e6c83bee3; from 2ba466d74ed74f073257f86e61519cb8f8f46184 before c77ad608df6c091fe64ecb91f41ef7cb465587f1; from 2ba466d74ed74f073257f86e61519cb8f8f46184 before 11a2edb70356a2202dcb7c9c189c8356ab4752cd; from 2ba466d74ed74f073257f86e61519cb8f8f46184 before 129dcd3e7d036218db3f59c82d82004b9539ed82; from 2ba466d74ed74f073257f86e61519cb8f8f46184 before d18b05eda7fa77f02114f15b02c009f28ee42346; from 2ba466d74ed74f073257f86e61519cb8f8f46184 before 59f14875a96ef93f05b82ad3c980605f2cb444b5; from 2ba466d74ed74f073257f86e61519cb8f8f46184 before 7373a51e7998b508af7136530f3a997b286ce81c	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.0 before V3.1.5	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.0 before V3.1.5	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.0 before V3.1.5	CISA ADP
linux linux_kernel linux:linux_kernel	from 2.6.30 before 4.19.317; from 4.20 before 5.4.279; from 5.5 before 5.10.221; from 5.11 before 5.15.162; from 5.16 before 6.1.95; from 6.2 before 6.6.35; from 6.7 before 6.9.5; 6.10; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/2ac8a2fe22bdde9eecce2a42cf5cab79333fb428	patch
https://git.kernel.org/stable/c/405b71f1251e5ae865f53bd27c45114e6c83bee3	patch
https://git.kernel.org/stable/c/c77ad608df6c091fe64ecb91f41ef7cb465587f1	patch
https://git.kernel.org/stable/c/11a2edb70356a2202dcb7c9c189c8356ab4752cd	patch
https://git.kernel.org/stable/c/129dcd3e7d036218db3f59c82d82004b9539ed82	patch
https://git.kernel.org/stable/c/d18b05eda7fa77f02114f15b02c009f28ee42346	patch
https://git.kernel.org/stable/c/59f14875a96ef93f05b82ad3c980605f2cb444b5	patch
https://git.kernel.org/stable/c/7373a51e7998b508af7136530f3a997b286ce81c	patch
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
https://cert-portal.siemens.com/productcert/html/ssa-355557.html
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.