CVE-2024-26878: Debian Linux

Medium severity, CVSS 4.7. EPSS: 0.2% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: quota: Fix potential NULL pointer dereference Below race may cause NULL pointer dereference P1 P2 dquot_free_inode quota_off drop_dquot_ref remove_dquot_ref dquots = i_dquot(inode) dquots = i_dquot(inode) srcu_read_lock dquots[cnt]) != NULL (1) dquots[type] = NULL (2) spin_lock(&dquots[cnt]->dq_dqb_lock) (3) .... If dquot_free_inode(or other routines) checks inode's quota pointers (1) before quota_off sets it to NULL(2) and use it (3) after that, NULL pointer dereference will be triggered. So let's fix it by using a temporary pointer to avoid this issue.

Affected products

• Debian Debian Linux: version 10.0 only
• Linux Linux Kernel: before 4.19.311 (fixed in 4.19.311); from 4.20, before 5.4.273 (fixed in 5.4.273); from 5.5, before 5.10.214 (fixed in 5.10.214); from 5.11, before 5.15.153 (fixed in 5.15.153); from 5.16, before 6.1.83 (fixed in 6.1.83); from 6.2, before 6.6.23 (fixed in 6.6.23); …

Published 2024-04-17. Last modified 2026-06-17.