CVE-2024-46744: Squashfs: sanity check symbolic link size
Vulnerability summary
CVE-2024-46744 is a high (CVSS 7.8) vulnerability in linux. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 22.7% of scored vulnerabilities.
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 35 · Related 28Timeline
- 18-09-2024PublishedVulnerability first disclosed.
- 15-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: Squashfs: sanity check symbolic link size Syzkiller reports a "KMSAN: uninit-value in pick_link" bug. This is caused by an uninitialised page, which is ultimately caused by a corrupted symbolic link size read from disk. The reason why the corrupted symlink size causes an uninitialised page is due to the following sequence of events: 1. squashfs_read_inode() is called to read the symbolic link from disk. This assigns the corrupted value 3875536935 to inode->i_size. 2. Later squashfs_symlink_read_folio() is called, which assigns this corrupted value to the length variable, which being a signed int, overflows producing a negative number. 3. The following loop that fills in the page contents checks that the copied bytes is less than length, which being negative means the loop is skipped, producing an uninitialised page. This patch adds a sanity check which checks that the symbolic link size is not larger than expected. -- V2: fix spelling mistake.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.30%
Chance of exploitation in the next 30 days
Percentile
23%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.30% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu129 products
- linuxAll versions (No fix recorded) | < 5.4.0-200.220 | < 5.15.0-125.135 | < 6.8.0-50.51
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.4.0-1135.145 | < 5.15.0-1072.78 | < 6.8.0-1020.22
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 6545b246a2c815a8fcd07d58240effb6ec3481b1, < f82cb7f24032ed023fc67d26ea9bf322d8431a90 | ≥ 6545b246a2c815a8fcd07d58240effb6ec3481b1, < 1b9451ba6f21478a75288ea3e3fca4be35e2a438 | ≥ 6545b246a2c815a8fcd07d58240effb6ec3481b1, < 5c8906de98d0d7ad42ff3edf2cb6cd7e0ea658c4 | ≥ 6545b246a2c815a8fcd07d58240effb6ec3481b1, < 087f25b2d36adae19951114ffcbb7106ed405ebb | ≥ 6545b246a2c815a8fcd07d58240effb6ec3481b1, < fac5e82ab1334fc8ed6ff7183702df634bd1d93d | ≥ 6545b246a2c815a8fcd07d58240effb6ec3481b1, < c3af7e460a526007e4bed1ce3623274a1a6afe5e | ≥ 6545b246a2c815a8fcd07d58240effb6ec3481b1, < ef4e249971eb77ec33d74c5c3de1e2576faf6c90 | ≥ 6545b246a2c815a8fcd07d58240effb6ec3481b1, < 810ee43d9cd245d138a2733d87a24858a23f577d | 2.6.29
- linux_kernel< 4.19.322 | ≥ 4.20, < 5.4.284 | ≥ 5.5, < 5.10.226 | ≥ 5.11, < 5.15.167 | ≥ 5.16, < 6.1.110 | ≥ 6.2, < 6.6.51 | ≥ 6.7, < 6.10.10 | 6.11:rc1 | 6.11:rc2 | 6.11:rc3
Debian1 product
- linux< 6.1.112-1 | < 6.10.11-1
3 vendors · 132 products
