In the Linux kernel, the following vulnerability has been resolved:
btrfs: free exchange changeset on failures
Fstests runs on my VMs have show several kmemleak reports like the following.
unreferenced object 0xffff88811ae59080 (size 64): comm "xfs_io", pid 12124, jiffies 4294987392 (age 6.368s) hex dump (first 32 bytes): 00 c0 1c 00 00 00 00 00 ff cf 1c 00 00 00 00 00 ................ 90 97 e5 1a 81 88 ff ff 90 97 e5 1a 81 88 ff ff ................ backtrace: [<00000000ac0176d2>] ulist_add_merge+0x60/0x150 [btrfs] [<0000000076e9f312>] set_state_bits+0x86/0xc0 [btrfs] [<0000000014fe73d6>] set_extent_bit+0x270/0x690 [btrfs] [<000000004f675208>] set_record_extent_bits+0x19/0x20 [btrfs] [<00000000b96137b1>] qgroup_reserve_data+0x274/0x310 [btrfs] [<0000000057e9dcbb>] btrfs_check_data_free_space+0x5c/0xa0 [btrfs] [<0000000019c4511d>] btrfs_delalloc_reserve_space+0x1b/0xa0 [btrfs] [<000000006d37e007>] btrfs_dio_iomap_begin+0x415/0x970 [btrfs] [<00000000fb8a74b8>] iomap_iter+0x161/0x1e0 [<0000000071dff6ff>] __iomap_dio_rw+0x1df/0x700 [<000000002567ba53>] iomap_dio_rw+0x5/0x20 [<0000000072e555f8>] btrfs_file_write_iter+0x290/0x530 [btrfs] [<000000005eb3d845>] new_sync_write+0x106/0x180 [<000000003fb505bf>] vfs_write+0x24d/0x2f0 [<000000009bb57d37>] __x64_sys_pwrite64+0x69/0xa0 [<000000003eba3fdf>] do_syscall_64+0x43/0x90
In case brtfs_qgroup_reserve_data() or btrfs_delalloc_reserve_metadata() fail the allocated extent_changeset will not be freed.
So in btrfs_check_data_free_space() and btrfs_delalloc_reserve_space() free the allocated extent_changeset to get rid of the allocated memory.
The issue currently only happens in the direct IO write path, but only after 65b3c08606e5 ("btrfs: fix ENOSPC failure when attempting direct IO write into NOCOW range"), and also at defrag_one_locked_target(). Every other place is always calling extent_changeset_free() even if its call to btrfs_delalloc_reserve_space() or btrfs_check_data_free_space() has failed.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 24, 2024 |
| Suse | — | Upgrade kernel-rt-livepatch-develUpgrade cluster-md-kmp-64kbUpgrade gfs2-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade kernel-64kb-optionalUpgrade kernel-debug-livepatch-develUpgrade dtb-hisiliconUpgrade kernel-syms-rtUpgrade kernel-debug-vdsoUpgrade dlm-kmp-azureUpgrade reiserfs-kmp-64kbUpgrade dtb-socionextUpgrade kselftests-kmp-rtUpgrade kernel-rt_debug-develUpgrade kernel-64kb-livepatch-develUpgrade kernel-64kb-extraUpgrade kselftests-kmp-defaultUpgrade dtb-marvellUpgrade kernel-obs-qaUpgrade dtb-broadcomUpgrade reiserfs-kmp-rtUpgrade dtb-amdUpgrade kernel-azure-extraUpgrade dtb-appleUpgrade kernel-source-vanillaUpgrade kernel-docs-htmlUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-defaultUpgrade kernel-debug-develUpgrade kernel-azure-vdsoUpgrade dlm-kmp-defaultUpgrade kernel-default-extraUpgrade kernel-rt-vdsoUpgrade kernel-64kbUpgrade kernel-default-livepatchUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt-optionalUpgrade kernel-source-rtUpgrade dtb-amazonUpgrade dtb-renesasUpgrade dtb-amlogicUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-defaultUpgrade dtb-sprdUpgrade ocfs2-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade ocfs2-kmp-rtUpgrade kernel-rt_debugUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-baseUpgrade kernel-macrosUpgrade kselftests-kmp-azureUpgrade kernel-debugUpgrade kernel-docsUpgrade kernel-azureUpgrade dtb-apmUpgrade dtb-freescaleUpgrade kernel-default-develUpgrade kernel-zfcpdumpUpgrade kernel-rt_debug-vdsoUpgrade kernel-devel-azureUpgrade kernel-kvmsmall-develUpgrade ocfs2-kmp-defaultUpgrade kernel-sourceUpgrade kernel-devel-rtUpgrade kernel-64kb-develUpgrade dlm-kmp-64kbUpgrade dtb-mediatekUpgrade kernel-azure-develUpgrade dtb-lgUpgrade gfs2-kmp-rtUpgrade reiserfs-kmp-azureUpgrade dtb-qcomUpgrade dtb-armUpgrade kernel-rt-livepatchUpgrade kernel-rt-extraUpgrade kernel-obs-buildUpgrade dtb-xilinxUpgrade dtb-allwinnerUpgrade dtb-nvidiaUpgrade kernel-syms-azureUpgrade kernel-source-azureUpgrade ocfs2-kmp-azureUpgrade kernel-rt-develUpgrade kernel-default-optionalUpgrade kernel-default-vdsoUpgrade dtb-caviumUpgrade dtb-rockchipUpgrade dtb-exynosUpgrade kernel-symsUpgrade kernel-rtUpgrade gfs2-kmp-defaultUpgrade cluster-md-kmp-azureUpgrade kernel-azure-optionalUpgrade kernel-azure-livepatch-develUpgrade kernel-default-base-rebuildUpgrade gfs2-kmp-azureUpgrade dtb-alteraUpgrade kernel-develUpgrade cluster-md-kmp-rtUpgrade kselftests-kmp-64kbUpgrade kernel-kvmsmall | Aug 9, 2024 | May 24, 2024 |
| Ubuntu | — | No solution existsUpgrade linux-azure-fde-5.15 | Jun 26, 2025 | May 24, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub