Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L H L N U N N H 4.7 .0019 8.0 —
AFFECTED Product Versions Fixed Linux 7b9ca4c61bc278b771fb57d6290a31ab1fc7fdac – — Linux 4.14 – 4.19.311
TIMELINE Feb 19 Reserved by Linux Apr 17 Published (CNA: Linux) Oct 15 ENRICHED — CVE-2024-26878 (Linux). Received CVSS 4.7 and CPE data from NVD.
In the Linux kernel, the following vulnerability has been resolved: quota: Fix potential NULL pointer dereference Below race may cause NULL pointer dereference P1 P2 dquot_free_inode quota_off drop_dquot_ref remove_dquot_ref dquots = i_dquot(inode) dquots = i_dquot(inode) srcu_read_lock dquots[cnt]) != NULL (1) dquots[type] = NULL (2) spin_lock(&dquots[cnt]->dq_dqb_lock) (3) .... If dquot_free_inode(or other routines) checks inode's quota pointers (1) before quota_off sets it to NULL(2) and use it (3) after that, NULL pointer dereference will be triggered. So let's fix it by using a temporary pointer to avoid this issue.
| Date | Event | Detail |
|---|---|---|
| February 19, 2024 | Reserved | Reserved by Linux |
| April 17, 2024 | Published | Published (CNA: Linux) |
| October 15, 2026 | ENRICHED | ENRICHED — CVE-2024-26878 (Linux). Received CVSS 4.7 and CPE data from NVD. |
Authoritative record: CVE-2024-26878 at cve.org
Vendors: linux
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-26878 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
