{"id":"CVE-2024-40971","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: remove clear SB_INLINECRYPT flag in default_options\n\nIn f2fs_remount, SB_INLINECRYPT flag will be clear and re-set.\nIf create new file or open file during this ga…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: remove clear SB_INLINECRYPT flag in default_options\n\nIn f2fs_remount, SB_INLINECRYPT flag will be clear and re-set.\nIf create new file or open file during this ga…","severity":"high","cvss":7.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 3.8, < 5.10.221","linux_kernel >= 5.11, < 5.15.162","linux_kernel >= 5.16, < 6.1.96","linux_kernel >= 6.2, < 6.6.36","linux_kernel >= 6.7, < 6.9.7"],"patched":["linux_kernel 6.9.7"],"published":"2024-07-12","updated":"2026-10-15","sourceUpdated":"2026-10-15T01:18:39.327","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-40971","references":[{"url":"https://git.kernel.org/stable/c/38a82c8d00638bb642bef787eb1d5e0e4d3b7d71","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/724429db09e21ee153fef35e34342279d33df6ae","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a9cea0489c562c97cd56bb345e78939f9909e7f4","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ac5eecf481c29942eb9a862e758c0c8b68090c33","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ae39c8ec4250d2a35ddaab1c40faacfec306ff66","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eddeb8d941d5be11a9da5637dbe81ac37e8449a2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/38a82c8d00638bb642bef787eb1d5e0e4d3b7d71","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/724429db09e21ee153fef35e34342279d33df6ae","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/a9cea0489c562c97cd56bb345e78939f9909e7f4","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/ac5eecf481c29942eb9a862e758c0c8b68090c33","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/ae39c8ec4250d2a35ddaab1c40faacfec306ff66","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://git.kernel.org/stable/c/eddeb8d941d5be11a9da5637dbe81ac37e8449a2","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html","label":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-265688.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-355557.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00307,"epssPercentile":0.23315,"ingestedAt":"2026-10-15T03:30:12.723Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-09-10T17:02:54.463850Z"},"slug":"CVE-2024-40971","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: remove clear SB_INLINECRYPT flag in default_options\n\nIn f2fs_remount, SB_INLINECRYPT flag will be clear and re-set.\nIf create new file or open file during this gap, these files\nwill not use inlinecrypt. Worse case, it may lead to data\ncorruption if wrappedkey_v0 is enable.\n\nThread A:                               Thread B:\n\n-f2fs_remount\t\t\t\t-f2fs_file_open or f2fs_new_inode\n  -default_options\n\t<- clear SB_INLINECRYPT flag\n\n                                          -fscrypt_select_encryption_impl\n\n  -parse_options\n\t<- set SB_INLINECRYPT again\n\n## Affected\n\n- `linux_kernel >= 3.8, < 5.10.221`\n- `linux_kernel >= 5.11, < 5.15.162`\n- `linux_kernel >= 5.16, < 6.1.96`\n- `linux_kernel >= 6.2, < 6.6.36`\n- `linux_kernel >= 6.7, < 6.9.7`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.9.7`","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":40.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}