---
id: CVE-2024-41016
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()

  xattr in ocfs2 maybe 'non-indexed', which saved with additional space
  requested
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()

  xattr in ocfs2 maybe 'non-indexed', which saved with additional space
  requested.  It's better to ch…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: linux
product: linux_kernel
affected:
  - linux_kernel < 4.19.323
  - 'linux_kernel >= 4.20, < 5.4.285'
  - 'linux_kernel >= 5.5, < 5.10.227'
  - 'linux_kernel >= 5.11, < 5.15.168'
  - 'linux_kernel >= 5.16, < 6.1.112'
  - 'linux_kernel >= 6.2, < 6.6.53'
  - 'linux_kernel >= 6.7, < 6.10.12'
patched:
  - linux_kernel 6.10.12
published: '2024-07-29'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:18:41.447'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-41016'
references:
  - url: 'https://git.kernel.org/stable/c/57a3d89831fcaa2cdbe024b47c7c36d5a56c3637'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/af77c4fc1871847b528d58b7fdafb4aa1f6a9262'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c031d286eceb82f72f8623b7f4abd2aa491bfb5e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c726dea9d0c806d64c26fcef483b1fb9474d8c5e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cfb926051fab19b10d1e65976211f364aa820180'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e2b3d7a9d019d4d1a0da6c3ea64a1ff79c99c090'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e4ffea01adf3323c821b6f37e9577d2d400adbaa'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e8f9c4af7af7e9e4cd09c0251c7936593147419f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/af77c4fc1871847b528d58b7fdafb4aa1f6a9262'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-265688.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00247
epssPercentile: 0.15959
ingestedAt: '2026-10-15T03:30:12.726Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-09-10T16:24:43.120825Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()

xattr in ocfs2 maybe 'non-indexed', which saved with additional space
requested.  It's better to check if the memory is out of bound before
memcmp, although this possibility mainly comes from crafted poisonous
images.

## Affected

- `linux_kernel < 4.19.323`
- `linux_kernel >= 4.20, < 5.4.285`
- `linux_kernel >= 5.5, < 5.10.227`
- `linux_kernel >= 5.11, < 5.15.168`
- `linux_kernel >= 5.16, < 6.1.112`
- `linux_kernel >= 6.2, < 6.6.53`
- `linux_kernel >= 6.7, < 6.10.12`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.10.12`