CVE-2024-57940exfat: fix the infinite loop in exfat_readdir()
Updated under an hour ago ()
Does this affect you?
It affects Linux and 3 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: exfat: fix the infinite loop in exfat_readdir() If the file system is corrupted so that a cluster is linked to itself in the cluster chain, and there is an unused directory entry in the cluster, 'dentry' will not be incremented, causing condition 'dentry < max_dentries' unable to prevent an infinite loop. This infinite loop causes s_lock not to be released, and other tasks will hang, such as exfat_sync_fs(). This commit stops traversing the cluster chain when there is unused directory entry in the cluster to avoid this infinite loop.
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 15, 2026
Affected products
Linux Linux linux:linux (from the name) | from ca06197382bde0a3bc20215595d1c9ce20c6e341 before d8cfbb8723bd3d3222f360227a1cc15227189ca6; from ca06197382bde0a3bc20215595d1c9ce20c6e341 before 28c21f0ac5293a4bf19b3e0e32005d6dd31a6c17; from ca06197382bde0a3bc20215595d1c9ce20c6e341 before 31beabd0f47f8c3ed9965ba861c9e5b252d4920a; from ca06197382bde0a3bc20215595d1c9ce20c6e341 before dc1d7afceb982e8f666e70a582e6b5aa806de063; from ca06197382bde0a3bc20215595d1c9ce20c6e341 before d9ea94f5cd117d56e573696d0045ab3044185a15; from ca06197382bde0a3bc20215595d1c9ce20c6e341 before fee873761bd978d077d8c55334b4966ac4cb7b59 | CNA record |
Siemens SIMATIC S7-1500 TM MFP - BIOS siemens:simatic_s7_1500_tm_mfp_bios (from the name) | all versions | CISA ADP |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | before V1.1.1 | CISA ADP |
linux linux_kernel linux:linux_kernel | from 5.7 before 6.1.125; from 6.2 before 6.6.72; from 6.7 before 6.12.10; 6.13; 6.13; 6.13; 6.13; 6.13; and 1 more ranges | NVD |
References
- https://git.kernel.org/stable/c/d8cfbb8723bd3d3222f360227a1cc15227189ca6
- https://git.kernel.org/stable/c/28c21f0ac5293a4bf19b3e0e32005d6dd31a6c17
- https://git.kernel.org/stable/c/31beabd0f47f8c3ed9965ba861c9e5b252d4920apatch
- https://git.kernel.org/stable/c/dc1d7afceb982e8f666e70a582e6b5aa806de063patch
- https://git.kernel.org/stable/c/d9ea94f5cd117d56e573696d0045ab3044185a15patch
- https://git.kernel.org/stable/c/fee873761bd978d077d8c55334b4966ac4cb7b59patch
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html
- https://cert-portal.siemens.com/productcert/html/ssa-503939.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.