---
id: CVE-2024-53147
title: 'exfat: fix out-of-bounds access of directory entries'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  exfat: fix out-of-bounds access of directory entries

  In the case of the directory size is greater than or equal to
  the cluster size, if start_clu becomes an EOF cluste…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 <
    82dc96f0f4eec8afdde8467d21d1b6b989dbb20a
  - >-
    Linux >= 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 <
    a0120d6463368378539ef928cf067d02372efb8c
  - >-
    Linux >= 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 <
    3ddd1cb2b458ff6a193bc845f408dfff217db29e
  - >-
    Linux >= 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 <
    184fa506e392eb78364d9283c961217ff2c0617b
  - Linux 5.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-10-01T20:09:50.211363Z'
published: '2024-12-24'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:35:33.204Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-53147'
references:
  - url: 'https://git.kernel.org/stable/c/82dc96f0f4eec8afdde8467d21d1b6b989dbb20a'
  - url: 'https://git.kernel.org/stable/c/a0120d6463368378539ef928cf067d02372efb8c'
  - url: 'https://git.kernel.org/stable/c/3ddd1cb2b458ff6a193bc845f408dfff217db29e'
  - url: 'https://git.kernel.org/stable/c/184fa506e392eb78364d9283c961217ff2c0617b'
tags:
  - cve.org
epss: 0.00252
epssPercentile: 0.16576
ingestedAt: '2026-10-21T12:48:53.725Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

exfat: fix out-of-bounds access of directory entries

In the case of the directory size is greater than or equal to
the cluster size, if start_clu becomes an EOF cluster(an invalid
cluster) due to file system corruption, then the directory entry
where ei->hint_femp.eidx hint is outside the directory, resulting
in an out-of-bounds access, which may cause further file system
corruption.

This commit adds a check for start_clu, if it is an invalid cluster,
the file or directory will be treated as empty.

## Affected

- `Linux >= 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 < 82dc96f0f4eec8afdde8467d21d1b6b989dbb20a`
- `Linux >= 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 < a0120d6463368378539ef928cf067d02372efb8c`
- `Linux >= 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 < 3ddd1cb2b458ff6a193bc845f408dfff217db29e`
- `Linux >= 1acf1a564b6034b5af1e7fb23cb98cb3bb4f6003 < 184fa506e392eb78364d9283c961217ff2c0617b`
- `Linux 5.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.