CVE-2024-40972 is a medium-severity vulnerability in the Linux kernel's ext4 filesystem. It involves the creation of extended attribute (EA) inodes while holding a buffer lock, which can lead to deadlocks, especially when the filesystem is corrupted. The issue arises because allocation locking is nested under the buffer lock, potentially causing deadlocks with quota files containing xattr blocks as data blocks. The vulnerability has been resolved by moving the allocation of EA inodes out of the ext4_xattr_set_entry() function into its callers.