High 7.1Published Oct 21, 2024

CVE-2024-49900jfs: Fix uninit-value access of new_ea in ea_buffer

Updated under an hour ago (2026-10-19 06:50 UTC)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: jfs: Fix uninit-value access of new_ea in ea_buffer syzbot reports that lzo1x_1_do_compress is using uninit-value: ===================================================== BUG: KMSAN: uninit-value in lzo1x_1_do_compress+0x19f9/0x2510 lib/lzo/lzo1x_compress.c:178 ... Uninit was stored to memory at: ea_put fs/jfs/xattr.c:639 [inline] ... Local variable ea_buf created at: __jfs_setxattr+0x5d/0x1ae0 fs/jfs/xattr.c:662 __jfs_xattr_set+0xe6/0x1f0 fs/jfs/xattr.c:934 ===================================================== The reason is ea_buf->new_ea is not initialized properly. Fix this by using memset to empty its content at the beginning in ea_get().

CVSS: 7.1 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 15, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 7b24d41d47a6805c45378debf8bd115675d41da8; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before dac398ed272a378d2f42ac68ae408333a51baf52; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 8b1dcf25c26d42e4a68c4725ce52a0543c7878cc; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before d7444f91a9f93eaa48827087ed0f3381c194181d; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 6041536d18c5f51a84bc37cd568cbab61870031e; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before c076b3746224982eebdba5c9e4b1467e146c0d64; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 7c244d5b48284a770d96ff703df2dfeadf804a73; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 8ad8b531de79c348bcb8133e7f5e827b884226af; and 1 more ranges	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	before V1.1.1	CISA ADP
linux linux_kernel linux:linux_kernel	before 5.10.227; from 5.11 before 5.15.168; from 5.16 before 6.1.113; from 6.2 before 6.6.55; from 6.7 before 6.10.14; from 6.11 before 6.11.3	NVD

References

https://git.kernel.org/stable/c/7b24d41d47a6805c45378debf8bd115675d41da8
https://git.kernel.org/stable/c/dac398ed272a378d2f42ac68ae408333a51baf52
https://git.kernel.org/stable/c/8b1dcf25c26d42e4a68c4725ce52a0543c7878ccpatch
https://git.kernel.org/stable/c/d7444f91a9f93eaa48827087ed0f3381c194181dpatch
https://git.kernel.org/stable/c/6041536d18c5f51a84bc37cd568cbab61870031epatch
https://git.kernel.org/stable/c/c076b3746224982eebdba5c9e4b1467e146c0d64patch
https://git.kernel.org/stable/c/7c244d5b48284a770d96ff703df2dfeadf804a73patch
https://git.kernel.org/stable/c/8ad8b531de79c348bcb8133e7f5e827b884226afpatch
https://git.kernel.org/stable/c/2b59ffad47db1c46af25ccad157bb3b25147c35cpatch
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
https://cert-portal.siemens.com/productcert/html/ssa-265688.html
https://cert-portal.siemens.com/productcert/html/ssa-355557.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.