High 7.8Published Aug 17, 2024

CVE-2024-42304ext4: make sure the first directory block is not a hole

Updated under an hour ago (Oct 28, 2026, 9:10 AM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ext4: make sure the first directory block is not a hole The syzbot constructs a directory that has no dirblock but is non-inline, i.e. the first directory block is a hole. And no errors are reported when creating files in this directory in the following flow. ext4_mknod ... ext4_add_entry // Read block 0 ext4_read_dirblock(dir, block, DIRENT) bh = ext4_bread(NULL, inode, block, 0) if (!bh && (type == INDEX || type == DIRENT_HTREE)) // The first directory block is a hole // But type == DIRENT, so no error is reported. After that, we get a directory block without '.' and '..' but with a valid dentry. This may cause some code that relies on dot or dotdot (such as make_indexed_dir()) to crash. Therefore when ext4_read_dirblock() finds that the first directory block is a hole report that the filesystem is corrupted and return an error to avoid loading corrupted data from disk causing something bad.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 14, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 3a17ca864baffc0c6f6e8aad525aa4365775a193 before d81d7e347d1f1f48a5634607d39eb90c161c8afe; from 4e19d6b65fb4fc42e352ce9883649e049da14743 before e02f9941e8c011aa3eafa799def6a134ce06bcfa; from 4e19d6b65fb4fc42e352ce9883649e049da14743 before de2a011a13a46468a6e8259db58b1b62071fe136; from 4e19d6b65fb4fc42e352ce9883649e049da14743 before 9771e3d8365ae1dd5e8846a204cb9af14e3e656a; from 4e19d6b65fb4fc42e352ce9883649e049da14743 before b609753cbbd38f8c0affd4956c0af178348523ac; from 4e19d6b65fb4fc42e352ce9883649e049da14743 before c3893d9de8ee153baac56d127d844103488133b5; from 4e19d6b65fb4fc42e352ce9883649e049da14743 before 299bc6ffa57e04e74c6cce866d6c0741fb4897a1; from 4e19d6b65fb4fc42e352ce9883649e049da14743 before f9ca51596bbfd0f9c386dd1c613c394c78d9e5e6; and 9 more ranges	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	before V1.1.1	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.9.187 before 4.10; from 4.14.135 before 4.15; from 4.19.62 before 4.19.320; from 5.1.21 before 5.2; from 5.2.4 before 5.4.282; from 5.5 before 5.10.224; from 5.11 before 5.15.165; from 5.16 before 6.1.103; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/d81d7e347d1f1f48a5634607d39eb90c161c8afe	patch
https://git.kernel.org/stable/c/e02f9941e8c011aa3eafa799def6a134ce06bcfa	patch
https://git.kernel.org/stable/c/de2a011a13a46468a6e8259db58b1b62071fe136	patch
https://git.kernel.org/stable/c/9771e3d8365ae1dd5e8846a204cb9af14e3e656a	patch
https://git.kernel.org/stable/c/b609753cbbd38f8c0affd4956c0af178348523ac	patch
https://git.kernel.org/stable/c/c3893d9de8ee153baac56d127d844103488133b5	patch
https://git.kernel.org/stable/c/299bc6ffa57e04e74c6cce866d6c0741fb4897a1	patch
https://git.kernel.org/stable/c/f9ca51596bbfd0f9c386dd1c613c394c78d9e5e6	patch
https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.