---
id: CVE-2024-49889
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ext4: avoid use-after-free in ext4_ext_show_leaf()

  In ext4_find_extent(), path may be freed by error or be reallocated, so
  using a previously saved *ppath may have bee…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ext4: avoid use-after-free in ext4_ext_show_leaf()

  In ext4_find_extent(), path may be freed by error or be reallocated, so
  using a previously saved *ppath may have bee…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
vendor: linux
product: linux_kernel
affected:
  - linux_kernel < 5.10.227
  - 'linux_kernel >= 5.11, < 5.15.168'
  - 'linux_kernel >= 5.16, < 6.1.113'
  - 'linux_kernel >= 6.2, < 6.6.55'
  - 'linux_kernel >= 6.7, < 6.10.14'
  - 'linux_kernel >= 6.11, < 6.11.3'
patched:
  - linux_kernel 6.11.3
published: '2024-10-21'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T01:18:59.523'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-49889'
references:
  - url: 'https://git.kernel.org/stable/c/2eba3b0cc5b8de624918d21f32b5b8db59a90b39'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/34b2096380ba475771971a778a478661a791aa15'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4999fed877bb64e3e7f9ab9996de2ca983c41928'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4e2524ba2ca5f54bdbb9e5153bea00421ef653f5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8b114f2cc7dd5d36729d040b68432fbd0f0a8868'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b0cb4561fc4284d04e69c8a66c8504928ab2484e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d483c7cc1796bd6a80e7b3a8fd494996260f6b67'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-265688.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-355557.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.00257
epssPercentile: 0.17227
ingestedAt: '2026-10-15T03:30:12.752Z'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-10-22T13:44:36.395156Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ext4: avoid use-after-free in ext4_ext_show_leaf()

In ext4_find_extent(), path may be freed by error or be reallocated, so
using a previously saved *ppath may have been freed and thus may trigger
use-after-free, as follows:

ext4_split_extent
  path = *ppath;
  ext4_split_extent_at(ppath)
  path = ext4_find_extent(ppath)
  ext4_split_extent_at(ppath)
    // ext4_find_extent fails to free path
    // but zeroout succeeds
  ext4_ext_show_leaf(inode, path)
    eh = path[depth].p_hdr
    // path use-after-free !!!

Similar to ext4_split_extent_at(), we use *ppath directly as an input to
ext4_ext_show_leaf(). Fix a spelling error by the way.

Same problem in ext4_ext_handle_unwritten_extents(). Since 'path' is only
used in ext4_ext_show_leaf(), remove 'path' and use *ppath directly.

This issue is triggered only when EXT_DEBUG is defined and therefore does
not affect functionality.

## Affected

- `linux_kernel < 5.10.227`
- `linux_kernel >= 5.11, < 5.15.168`
- `linux_kernel >= 5.16, < 6.1.113`
- `linux_kernel >= 6.2, < 6.6.55`
- `linux_kernel >= 6.7, < 6.10.14`
- `linux_kernel >= 6.11, < 6.11.3`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.11.3`