In the Linux kernel, the following vulnerability has been resolved:
btrfs: free exchange changeset on failures
Fstests runs on my VMs have show several kmemleak reports like the following.
unreferenced object 0xffff88811ae59080 (size 64): comm "xfs_io", pid 12124, jiffies 4294987392 (age 6.368s) hex dump (first 32 bytes): 00 c0 1c 00 00 00 00 00 ff cf 1c 00 00 00 00 00 ................ 90 97 e5 1a 81 88 ff ff 90 97 e5 1a 81 88 ff ff ................ backtrace: [<00000000ac0176d2>] ulist_add_merge+0x60/0x150 [btrfs] [<0000000076e9f312>] set_state_bits+0x86/0xc0 [btrfs] [<0000000014fe73d6>] set_extent_bit+0x270/0x690 [btrfs] [<000000004f675208>] set_record_extent_bits+0x19/0x20 [btrfs] [<00000000b96137b1>] qgroup_reserve_data+0x274/0x310 [btrfs] [<0000000057e9dcbb>] btrfs_check_data_free_space+0x5c/0xa0 [btrfs] [<0000000019c4511d>] btrfs_delalloc_reserve_space+0x1b/0xa0 [btrfs] [<000000006d37e007>] btrfs_dio_iomap_begin+0x415/0x970 [btrfs] [<00000000fb8a74b8>] iomap_iter+0x161/0x1e0 [<0000000071dff6ff>] __iomap_dio_rw+0x1df/0x700 [<000000002567ba53>] iomap_dio_rw+0x5/0x20 [<0000000072e555f8>] btrfs_file_write_iter+0x290/0x530 [btrfs] [<000000005eb3d845>] new_sync_write+0x106/0x180 [<000000003fb505bf>] vfs_write+0x24d/0x2f0 [<000000009bb57d37>] __x64_sys_pwrite64+0x69/0xa0 [<000000003eba3fdf>] do_syscall_64+0x43/0x90
In case brtfs_qgroup_reserve_data() or btrfs_delalloc_reserve_metadata() fail the allocated extent_changeset will not be freed.
So in btrfs_check_data_free_space() and btrfs_delalloc_reserve_space() free the allocated extent_changeset to get rid of the allocated memory.
The issue currently only happens in the direct IO write path, but only after 65b3c08606e5 ("btrfs: fix ENOSPC failure when attempting direct IO write into NOCOW range"), and also at defrag_one_locked_target(). Every other place is always calling extent_changeset_free() even if its call to btrfs_delalloc_reserve_space() or btrfs_check_data_free_space() has failed.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 24, 2024 |
| Suse | — | Upgrade kernel-debug-livepatch-develUpgrade kselftests-kmp-rtUpgrade reiserfs-kmp-64kbUpgrade dlm-kmp-azureUpgrade dtb-appleUpgrade kernel-64kb-extraUpgrade kernel-debug-vdsoUpgrade dtb-hisiliconUpgrade cluster-md-kmp-defaultUpgrade kernel-azureUpgrade dtb-sprdUpgrade reiserfs-kmp-defaultUpgrade kernel-default-baseUpgrade dtb-socionextUpgrade ocfs2-kmp-rtUpgrade kernel-rt_debugUpgrade reiserfs-kmp-rtUpgrade kernel-debug-develUpgrade dlm-kmp-rtUpgrade kernel-macrosUpgrade ocfs2-kmp-64kbUpgrade kernel-syms-rtUpgrade kernel-default-livepatch-develUpgrade kernel-defaultUpgrade dtb-amlogicUpgrade kernel-64kb-livepatch-develUpgrade kernel-rt_debug-develUpgrade gfs2-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade cluster-md-kmp-64kbUpgrade kernel-azure-vdsoUpgrade dtb-marvellUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-64kb-optionalUpgrade dtb-amdUpgrade kernel-default-extraUpgrade kernel-default-livepatchUpgrade dlm-kmp-defaultUpgrade kernel-docs-htmlUpgrade kernel-default-develUpgrade kernel-rt-optionalUpgrade kernel-64kbUpgrade kernel-zfcpdumpUpgrade kernel-debugUpgrade dtb-amazonUpgrade kselftests-kmp-defaultUpgrade kernel-azure-extraUpgrade kernel-rt-vdsoUpgrade dtb-broadcomUpgrade kernel-obs-qaUpgrade dtb-freescaleUpgrade dtb-apmUpgrade kernel-docsUpgrade kernel-source-rtUpgrade kernel-kvmsmall-vdsoUpgrade kernel-source-vanillaUpgrade kernel-rt_debug-vdsoUpgrade kselftests-kmp-azureUpgrade dtb-renesasUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-64kb-develUpgrade kernel-kvmsmallUpgrade kernel-devel-rtUpgrade kernel-azure-livepatch-develUpgrade gfs2-kmp-azureUpgrade dtb-alteraUpgrade cluster-md-kmp-rtUpgrade dlm-kmp-64kbUpgrade kernel-azure-develUpgrade dtb-lgUpgrade kernel-default-vdsoUpgrade dtb-rockchipUpgrade gfs2-kmp-defaultUpgrade kernel-kvmsmall-develUpgrade cluster-md-kmp-azureUpgrade kernel-rtUpgrade kernel-rt-develUpgrade kernel-syms-azureUpgrade dtb-qcomUpgrade dtb-armUpgrade dtb-nvidiaUpgrade kernel-rt-livepatchUpgrade kernel-default-optionalUpgrade kernel-source-azureUpgrade dtb-caviumUpgrade kernel-devel-azureUpgrade dtb-exynosUpgrade reiserfs-kmp-azureUpgrade kernel-symsUpgrade kernel-sourceUpgrade ocfs2-kmp-defaultUpgrade dtb-xilinxUpgrade kernel-azure-optionalUpgrade kernel-obs-buildUpgrade dtb-allwinnerUpgrade kernel-rt-extraUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-64kbUpgrade kernel-develUpgrade dtb-mediatekUpgrade gfs2-kmp-rtUpgrade kernel-default-base-rebuild | Aug 9, 2024 | May 24, 2024 |
| Ubuntu | — | Upgrade linux-azure-fde-5.15No solution exists | Jun 26, 2025 | May 24, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub