In the Linux kernel, the following vulnerability has been resolved:
btrfs: free exchange changeset on failures
Fstests runs on my VMs have show several kmemleak reports like the following.
unreferenced object 0xffff88811ae59080 (size 64): comm "xfs_io", pid 12124, jiffies 4294987392 (age 6.368s) hex dump (first 32 bytes): 00 c0 1c 00 00 00 00 00 ff cf 1c 00 00 00 00 00 ................ 90 97 e5 1a 81 88 ff ff 90 97 e5 1a 81 88 ff ff ................ backtrace: [<00000000ac0176d2>] ulist_add_merge+0x60/0x150 [btrfs] [<0000000076e9f312>] set_state_bits+0x86/0xc0 [btrfs] [<0000000014fe73d6>] set_extent_bit+0x270/0x690 [btrfs] [<000000004f675208>] set_record_extent_bits+0x19/0x20 [btrfs] [<00000000b96137b1>] qgroup_reserve_data+0x274/0x310 [btrfs] [<0000000057e9dcbb>] btrfs_check_data_free_space+0x5c/0xa0 [btrfs] [<0000000019c4511d>] btrfs_delalloc_reserve_space+0x1b/0xa0 [btrfs] [<000000006d37e007>] btrfs_dio_iomap_begin+0x415/0x970 [btrfs] [<00000000fb8a74b8>] iomap_iter+0x161/0x1e0 [<0000000071dff6ff>] __iomap_dio_rw+0x1df/0x700 [<000000002567ba53>] iomap_dio_rw+0x5/0x20 [<0000000072e555f8>] btrfs_file_write_iter+0x290/0x530 [btrfs] [<000000005eb3d845>] new_sync_write+0x106/0x180 [<000000003fb505bf>] vfs_write+0x24d/0x2f0 [<000000009bb57d37>] __x64_sys_pwrite64+0x69/0xa0 [<000000003eba3fdf>] do_syscall_64+0x43/0x90
In case brtfs_qgroup_reserve_data() or btrfs_delalloc_reserve_metadata() fail the allocated extent_changeset will not be freed.
So in btrfs_check_data_free_space() and btrfs_delalloc_reserve_space() free the allocated extent_changeset to get rid of the allocated memory.
The issue currently only happens in the direct IO write path, but only after 65b3c08606e5 ("btrfs: fix ENOSPC failure when attempting direct IO write into NOCOW range"), and also at defrag_one_locked_target(). Every other place is always calling extent_changeset_free() even if its call to btrfs_delalloc_reserve_space() or btrfs_check_data_free_space() has failed.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 24, 2024 |
| Suse | — | Upgrade kselftests-kmp-azureUpgrade dtb-freescaleUpgrade kernel-debugUpgrade dtb-amdUpgrade ocfs2-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade dtb-apmUpgrade kernel-zfcpdumpUpgrade dlm-kmp-rtUpgrade kernel-default-baseUpgrade dtb-amlogicUpgrade dtb-renesasUpgrade kernel-docsUpgrade dtb-amazonUpgrade kernel-default-develUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-64kb-optionalUpgrade ocfs2-kmp-64kbUpgrade kernel-64kb-extraUpgrade kernel-macrosUpgrade dtb-appleUpgrade kernel-azureUpgrade dlm-kmp-azureUpgrade kernel-rt_debug-develUpgrade dtb-hisiliconUpgrade kselftests-kmp-rtUpgrade kernel-64kb-livepatch-develUpgrade gfs2-kmp-64kbUpgrade reiserfs-kmp-defaultUpgrade kernel-debug-livepatch-develUpgrade dtb-sprdUpgrade kernel-rt-livepatch-develUpgrade dtb-socionextUpgrade kernel-debug-vdsoUpgrade kernel-azure-vdsoUpgrade reiserfs-kmp-64kbUpgrade kernel-default-livepatchUpgrade kernel-64kbUpgrade dlm-kmp-defaultUpgrade kernel-rt-optionalUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-extraUpgrade kernel-source-rtUpgrade kernel-docs-htmlUpgrade kernel-rt_debug-livepatch-develUpgrade reiserfs-kmp-rtUpgrade kernel-rt-vdsoUpgrade cluster-md-kmp-64kbUpgrade kernel-azure-extraUpgrade dtb-marvellUpgrade kernel-source-vanillaUpgrade kernel-rt_debugUpgrade kernel-syms-rtUpgrade kernel-obs-qaUpgrade kselftests-kmp-defaultUpgrade kernel-defaultUpgrade kernel-default-livepatch-develUpgrade dtb-broadcomUpgrade kernel-debug-develUpgrade cluster-md-kmp-defaultUpgrade kernel-kvmsmallUpgrade dtb-nvidiaUpgrade kernel-azure-develUpgrade dtb-lgUpgrade gfs2-kmp-rtUpgrade dtb-mediatekUpgrade kernel-default-base-rebuildUpgrade dlm-kmp-64kbUpgrade kernel-develUpgrade kernel-64kb-develUpgrade dtb-alteraUpgrade kselftests-kmp-64kbUpgrade gfs2-kmp-azureUpgrade kernel-default-optionalUpgrade cluster-md-kmp-rtUpgrade dtb-rockchipUpgrade kernel-devel-rtUpgrade kernel-default-vdsoUpgrade dtb-allwinnerUpgrade kernel-obs-buildUpgrade dtb-xilinxUpgrade kernel-rt-extraUpgrade ocfs2-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade kernel-symsUpgrade dtb-armUpgrade kernel-source-azureUpgrade dtb-caviumUpgrade dtb-qcomUpgrade kernel-rt-livepatchUpgrade kernel-azure-livepatch-develUpgrade kernel-azure-optionalUpgrade gfs2-kmp-defaultUpgrade kernel-rtUpgrade kernel-syms-azureUpgrade kernel-rt-develUpgrade cluster-md-kmp-azureUpgrade kernel-kvmsmall-develUpgrade kernel-sourceUpgrade kernel-devel-azureUpgrade dtb-exynosUpgrade reiserfs-kmp-azure | Aug 9, 2024 | May 24, 2024 |
| Ubuntu | — | No solution existsUpgrade linux-azure-fde-5.15 | Jun 26, 2025 | May 24, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub