CVE-2024-35936

MEDIUM
Published May 19, 2024 Modified May 12, 2026

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() The unhandled case in btrfs_relocate_sys_chunks() loop is a corruption, as it could be caused only by two impossible conditions: - at first the search key is set up to look for a chunk tree item, with offset -1, this is an inexact search and the key->offset will contain the correct offset upon a successful search, a valid chunk tree item cannot have an offset -1 - after first successful search, the found_key corresponds to a chunk item, the offset is decremented by 1 before the next loop, it's impossible to find a chunk item there due to alignment and size constraints

Is your site exposed to CVE-2024-35936?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.5
MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected Products

Vendor Product
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
linux linux_kernel
debian debian_linux

References

Advisories & Patches

https://git.kernel.org/stable/c/0d23b34c68c46cd225b55868bc8a269e3134816d https://git.kernel.org/stable/c/1f9212cdbd005bc55f2b7422e7b560d9c02bd1da https://git.kernel.org/stable/c/36c2a2863bc3896243eb724dc3fd4cf9aea633f2 https://git.kernel.org/stable/c/576164bd01bd795f8b09fb194b493103506b33c9 https://git.kernel.org/stable/c/7411055db5ce64f836aaffd422396af0075fdc99 https://git.kernel.org/stable/c/87299cdaae757f3f41212146cfb5b3af416b8385 https://git.kernel.org/stable/c/bebd9e0ff90034875c5dfe4bd514fd7055fc7a89 https://git.kernel.org/stable/c/d1ffa4ae2d591fdd40471074e79954ec45f147f7 https://git.kernel.org/stable/c/0d23b34c68c46cd225b55868bc8a269e3134816d https://git.kernel.org/stable/c/1f9212cdbd005bc55f2b7422e7b560d9c02bd1da https://git.kernel.org/stable/c/36c2a2863bc3896243eb724dc3fd4cf9aea633f2 https://git.kernel.org/stable/c/576164bd01bd795f8b09fb194b493103506b33c9 https://git.kernel.org/stable/c/7411055db5ce64f836aaffd422396af0075fdc99 https://git.kernel.org/stable/c/87299cdaae757f3f41212146cfb5b3af416b8385 https://git.kernel.org/stable/c/bebd9e0ff90034875c5dfe4bd514fd7055fc7a89 https://git.kernel.org/stable/c/d1ffa4ae2d591fdd40471074e79954ec45f147f7

Frequently Asked Questions

What is CVE-2024-35936? +
In the Linux kernel, the following vulnerability has been resolved: btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() The unhandled case in btrfs_relocate_sys_chunks() loop is a corruption, as it could be caused only by two impossible conditions: - at first the search key is set up to look for a chunk tree item, with offset -1, this is an inexact search and the key->offset will contain the correct offset upon a successful search, a valid chunk tree item cannot have an offset -1 - after first successful search, the found_key corresponds to a chunk item, the offset is decremented by 1 before the next loop, it's impossible to find a chunk item there due to alignment and size constraints It has a CVSS v3.1 base score of 5.5 (MEDIUM).
How severe is CVE-2024-35936? +
CVE-2024-35936 has a CVSS v3.1 score of 5.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.
What products are affected by CVE-2024-35936? +
CVE-2024-35936 affects products from debian, linux, specifically: debian_linux, linux_kernel. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2024-35936? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-9588 10.0

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Iron Mountain Archiving Services Inc. …
CVE-2025-57870 10.0

A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This …
CVE-2026-48286 10.0

Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result …
CVE-2026-13782 10.0

Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer …
CVE-2026-48449 10.0

Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the …
CVE-2026-48303 10.0

Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization vulnerability that could result …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2024-35936 — free, no signup required.