{"cve":"CVE-2024-41034","nvd":{"published":"2024-07-29T15:15:11.990","modified":"2026-08-04T11:19:20.437","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix kernel bug on rename operation of broken directory\n\nSyzbot reported that in rename directory operation on broken directory on\nnilfs2, __block_write_begin_int() called to prepare block write may fail\nBUG_ON check for access exceeding the folio/page size.\n\nThis is because nilfs_dotdot(), which gets parent directory reference\nentry (\"..\") of the directory to be moved or renamed, does not check\nconsistency enough, and may return location exceeding folio/page size for\nbroken directories.\n\nFix this issue by checking required directory entries (\".\" and \"..\") in\nthe first chunk of the directory in nilfs_dotdot().","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":[],"references":["https://git.kernel.org/stable/c/1a8879c0771a68d70ee2e5e66eea34207e8c6231","https://git.kernel.org/stable/c/24c1c8566a9b6be51f5347be2ea76e25fc82b11e","https://git.kernel.org/stable/c/298cd810d7fb687c90a14d8f9fd1b8719a7cb8a5","https://git.kernel.org/stable/c/60f61514374e4a0c3b65b08c6024dd7e26150bfd","https://git.kernel.org/stable/c/7000b438dda9d0f41a956fc9bffed92d2eb6be0d"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T21:53:51.317825789+00:00"},"epss":{"cve":"CVE-2024-41034","score":0.00323,"percentile":0.25303,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}