In the Linux kernel, the following vulnerability has been resolved:
btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
If the source file descriptor to the snapshot ioctl refers to a deleted subvolume, we get the following abort:
BTRFS: Transaction aborted (error -2) WARNING: CPU: 0 PID: 833 at fs/btrfs/transaction.c:1875 create_pending_snapshot+0x1040/0x1190 [btrfs] Modules linked in: pata_acpi btrfs ata_piix libata scsi_mod virtio_net blake2b_generic xor net_failover virtio_rng failover scsi_common rng_core raid6_pq libcrc32c CPU: 0 PID: 833 Comm: t_snapshot_dele Not tainted 6.7.0-rc6 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014 RIP: 0010:create_pending_snapshot+0x1040/0x1190 [btrfs] RSP: 0018:ffffa09c01337af8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff9982053e7c78 RCX: 0000000000000027 RDX: ffff99827dc20848 RSI: 0000000000000001 RDI: ffff99827dc20840 RBP: ffffa09c01337c00 R08: 0000000000000000 R09: ffffa09c01337998 R10: 0000000000000003 R11: ffffffffb96da248 R12: fffffffffffffffe R13: ffff99820535bb28 R14: ffff99820b7bd000 R15: ffff99820381ea80 FS: 00007fe20aadabc0(0000) GS:ffff99827dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000559a120b502f CR3: 00000000055b6000 CR4: 00000000000006f0 Call Trace: <TASK> ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? __warn+0x81/0x130 ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? report_bug+0x171/0x1a0 ? handle_bug+0x3a/0x70 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? create_pending_snapshot+0x1040/0x1190 [btrfs] create_pending_snapshots+0x92/0xc0 [btrfs] btrfs_commit_transaction+0x66b/0xf40 [btrfs] btrfs_mksubvol+0x301/0x4d0 [btrfs] btrfs_mksnapshot+0x80/0xb0 [btrfs] __btrfs_ioctl_snap_create+0x1c2/0x1d0 [btrfs] btrfs_ioctl_snap_create_v2+0xc4/0x150 [btrfs] btrfs_ioctl+0x8a6/0x2650 [btrfs] ? kmem_cache_free+0x22/0x340 ? do_sys_openat2+0x97/0xe0 __x64_sys_ioctl+0x97/0xd0 do_syscall_64+0x46/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 RIP: 0033:0x7fe20abe83af RSP: 002b:00007ffe6eff1360 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007fe20abe83af RDX: 00007ffe6eff23c0 RSI: 0000000050009417 RDI: 0000000000000003 RBP: 0000000000000003 R08: 0000000000000000 R09: 00007fe20ad16cd0 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe6eff13c0 R14: 00007fe20ad45000 R15: 0000559a120b6d58 </TASK> ---[ end trace 0000000000000000 ]--- BTRFS: error (device vdc: state A) in create_pending_snapshot:1875: errno=-2 No such entry BTRFS info (device vdc: state EA): forced readonly BTRFS warning (device vdc: state EA): Skipping commit of aborted transaction. BTRFS: error (device vdc: state EA) in cleanup_transaction:2055: errno=-2 No such entry
This happens because create_pending_snapshot() initializes the new root item as a copy of the source root item. This includes the refs field, which is 0 for a deleted subvolume. The call to btrfs_insert_root() therefore inserts a root with refs == 0. btrfs_get_new_fs_root() then finds the root and returns -ENOENT if refs == 0, which causes create_pending_snapshot() to abort.
Fix it by checking the source root's refs before attempting the snapshot, but after locking subvol_sem to avoid racing with deletion.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade perfUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade kernelUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade bpftoolUpgrade kernel-headersUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-livepatch-5.15.149-99.161Upgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-5.10.210-201.852 | Aug 28, 2024 | Mar 26, 2024 |
| Amazon_linux_2023 | — | Upgrade bpftoolUpgrade kernel-libbpf-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade kernel-livepatch-6.1.77-99.164Upgrade python3-perf-debuginfoUpgrade kernel-toolsUpgrade kernel-develUpgrade kernel-libbpf-staticUpgrade kernel-modules-extra-commonUpgrade kernel-headersUpgrade kernel-modules-extraUpgrade python3-perfUpgrade perfUpgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-tools-develUpgrade bpftool-debuginfoUpgrade kernel-libbpfUpgrade kernel-tools-debuginfo | Feb 17, 2025 | Mar 26, 2024 |
| Debian | — | Upgrade linux | May 8, 2024 | Mar 26, 2024 |
| Oracle_linux | — | Upgrade kernel-uek | Oct 14, 2025 | Mar 26, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 26, 2024 |
| Suse | — | Upgrade kernel-rt_debug-vdsoUpgrade kernel-rtUpgrade kernel-devel-rtUpgrade kernel-debugUpgrade gfs2-kmp-rtUpgrade kernel-debug-develUpgrade cluster-md-kmp-defaultUpgrade kernel-source-azureUpgrade kernel-syms-rtUpgrade kernel-zfcpdumpUpgrade kernel-azure-extraUpgrade kernel-64kb-livepatch-develUpgrade kernel-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-azure-develUpgrade kernel-obs-qaUpgrade gfs2-kmp-64kbUpgrade dtb-exynosUpgrade kernel-azure-vdsoUpgrade kernel-debug-livepatch-develUpgrade kernel-azure-livepatch-develUpgrade dtb-freescaleUpgrade dtb-amazonUpgrade kernel-syms-azureUpgrade cluster-md-kmp-azureUpgrade dtb-armUpgrade kernel-rt-develUpgrade kernel-default-optionalUpgrade dtb-hisiliconUpgrade kselftests-kmp-defaultUpgrade kernel-kvmsmall-develUpgrade dtb-qcomUpgrade kernel-default-extraUpgrade kernel-64kb-optionalUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-mediatekUpgrade dtb-amlogicUpgrade ocfs2-kmp-rtUpgrade kernel-macrosUpgrade kernel-default-develUpgrade dtb-amdUpgrade dlm-kmp-azureUpgrade kernel-devel-azureUpgrade kernel-symsUpgrade kernel-64kb-develUpgrade dtb-appleUpgrade dtb-xilinxUpgrade dlm-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade dtb-apmUpgrade kernel-sourceUpgrade kernel-default-manUpgrade kernel-rt-livepatchUpgrade kernel-kvmsmallUpgrade dtb-lgUpgrade dtb-alteraUpgrade kernel-64kb-extraUpgrade gfs2-kmp-azureUpgrade kernel-kvmsmall-vdsoUpgrade cluster-md-kmp-64kbUpgrade dtb-caviumUpgrade kernel-rt_debug-develUpgrade kernel-rt-vdsoUpgrade kernel-rt-optionalUpgrade kernel-default-vdsoUpgrade dtb-socionextUpgrade dtb-nvidiaUpgrade reiserfs-kmp-rtUpgrade kernel-rt-extraUpgrade kernel-default-base-rebuildUpgrade ocfs2-kmp-azureUpgrade kernel-debug-vdsoUpgrade kernel-azureUpgrade kernel-default-livepatchUpgrade dtb-rockchipUpgrade kernel-docs-htmlUpgrade dtb-allwinnerUpgrade gfs2-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade kernel-source-rtUpgrade dtb-broadcomUpgrade dtb-marvellUpgrade kernel-rt_debugUpgrade dtb-renesasUpgrade kernel-azure-optionalUpgrade cluster-md-kmp-rtUpgrade kernel-develUpgrade dtb-sprdUpgrade kernel-default-livepatch-develUpgrade kernel-obs-buildUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-azureUpgrade dlm-kmp-defaultUpgrade kernel-docsUpgrade kselftests-kmp-rtUpgrade dlm-kmp-rtUpgrade kernel-source-vanillaUpgrade reiserfs-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-defaultUpgrade kernel-default-baseUpgrade kernel-default | Jul 10, 2024 | Mar 26, 2024 |
| Ubuntu | — | Upgrade linux-image-6.5.0-1018-raspiUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-6.5.0-1024-oracle-64kUpgrade linux-image-5.15.0-1054-raspiUpgrade linux-image-awsUpgrade linux-image-5.15.0-1058-gkeUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-gkeUpgrade linux-image-6.5.0-41-lowlatency-64kUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-nvidia-64k-6.5Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-5.15.0-1061-awsUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-6.5.0-1022-gcpUpgrade linux-image-aws-lts-22.04Upgrade linux-image-6.5.0-1021-nvidia-64kUpgrade linux-image-oem-20.04Upgrade linux-image-5.15.0-1063-azureUpgrade linux-image-6.5.0-1024-oemUpgrade linux-image-6.5.0-1021-awsUpgrade linux-image-6.5.0-41-generic-64kUpgrade linux-image-virtualUpgrade linux-image-kvmUpgrade linux-image-azure-cvmUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-generic-lpaeUpgrade linux-image-6.5.0-1017-laptopUpgrade linux-image-oracleUpgrade linux-image-azure-lts-22.04Upgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-generic-hwe-20.04Upgrade linux-image-6.5.0-1015-starfiveUpgrade linux-image-6.5.0-41-lowlatencyUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.5.0-1022-azure-fdeUpgrade linux-image-oem-22.04Upgrade linux-image-oem-22.04bUpgrade linux-image-oem-20.04bUpgrade linux-image-6.5.0-1024-oracleUpgrade linux-image-oem-22.04dUpgrade linux-image-6.5.0-41-genericUpgrade linux-image-oem-20.04dUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-1054-ibmUpgrade linux-image-raspiUpgrade linux-image-6.5.0-1021-nvidiaUpgrade linux-image-oem-20.04cUpgrade linux-image-gkeop-5.15Upgrade linux-image-5.15.0-106-lowlatencyUpgrade linux-image-intelUpgrade linux-image-5.15.0-1059-gcpUpgrade linux-image-gkeopUpgrade linux-image-5.15.0-1044-gkeopUpgrade linux-image-gcpUpgrade linux-image-5.15.0-106-genericUpgrade linux-image-5.15.0-1054-nvidiaUpgrade linux-image-lowlatencyUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-nvidiaUpgrade linux-image-generic-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-azure-fdeUpgrade linux-image-5.15.0-1058-kvmUpgrade linux-image-starfiveUpgrade linux-image-5.15.0-1059-oracleUpgrade linux-image-5.15.0-106-lowlatency-64kUpgrade linux-image-oem-22.04aUpgrade linux-image-laptop-23.10Upgrade linux-image-gke-5.15Upgrade linux-image-intel-iotgUpgrade linux-image-5.15.0-1063-azure-fdeUpgrade linux-image-5.15.0-1057-intel-iotgUpgrade linux-image-ibmUpgrade linux-image-oracle-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-5.15.0-1058-intel-iotgUpgrade linux-image-5.15.0-106-generic-64kUpgrade linux-image-6.5.0-1022-azureUpgrade linux-image-5.15.0-1054-nvidia-lowlatencyUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-nvidia-6.5Upgrade linux-image-azureUpgrade linux-image-5.15.0-106-generic-lpaeUpgrade linux-image-genericUpgrade linux-image-generic-hwe-22.04 | May 17, 2024 | Mar 26, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 26, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub