In the Linux kernel, the following vulnerability has been resolved:
btrfs: free exchange changeset on failures
Fstests runs on my VMs have show several kmemleak reports like the following.
unreferenced object 0xffff88811ae59080 (size 64): comm "xfs_io", pid 12124, jiffies 4294987392 (age 6.368s) hex dump (first 32 bytes): 00 c0 1c 00 00 00 00 00 ff cf 1c 00 00 00 00 00 ................ 90 97 e5 1a 81 88 ff ff 90 97 e5 1a 81 88 ff ff ................ backtrace: [<00000000ac0176d2>] ulist_add_merge+0x60/0x150 [btrfs] [<0000000076e9f312>] set_state_bits+0x86/0xc0 [btrfs] [<0000000014fe73d6>] set_extent_bit+0x270/0x690 [btrfs] [<000000004f675208>] set_record_extent_bits+0x19/0x20 [btrfs] [<00000000b96137b1>] qgroup_reserve_data+0x274/0x310 [btrfs] [<0000000057e9dcbb>] btrfs_check_data_free_space+0x5c/0xa0 [btrfs] [<0000000019c4511d>] btrfs_delalloc_reserve_space+0x1b/0xa0 [btrfs] [<000000006d37e007>] btrfs_dio_iomap_begin+0x415/0x970 [btrfs] [<00000000fb8a74b8>] iomap_iter+0x161/0x1e0 [<0000000071dff6ff>] __iomap_dio_rw+0x1df/0x700 [<000000002567ba53>] iomap_dio_rw+0x5/0x20 [<0000000072e555f8>] btrfs_file_write_iter+0x290/0x530 [btrfs] [<000000005eb3d845>] new_sync_write+0x106/0x180 [<000000003fb505bf>] vfs_write+0x24d/0x2f0 [<000000009bb57d37>] __x64_sys_pwrite64+0x69/0xa0 [<000000003eba3fdf>] do_syscall_64+0x43/0x90
In case brtfs_qgroup_reserve_data() or btrfs_delalloc_reserve_metadata() fail the allocated extent_changeset will not be freed.
So in btrfs_check_data_free_space() and btrfs_delalloc_reserve_space() free the allocated extent_changeset to get rid of the allocated memory.
The issue currently only happens in the direct IO write path, but only after 65b3c08606e5 ("btrfs: fix ENOSPC failure when attempting direct IO write into NOCOW range"), and also at defrag_one_locked_target(). Every other place is always calling extent_changeset_free() even if its call to btrfs_delalloc_reserve_space() or btrfs_check_data_free_space() has failed.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 24, 2024 |
| Suse | — | Upgrade kernel-rt-livepatchUpgrade kernel-obs-buildUpgrade kernel-rt-extraUpgrade reiserfs-kmp-azureUpgrade kernel-sourceUpgrade kernel-default-base-rebuildUpgrade kernel-default-optionalUpgrade dtb-allwinnerUpgrade kernel-azure-develUpgrade kernel-rt-develUpgrade cluster-md-kmp-azureUpgrade kernel-develUpgrade dtb-xilinxUpgrade ocfs2-kmp-azureUpgrade dtb-alteraUpgrade kernel-symsUpgrade kselftests-kmp-64kbUpgrade kernel-devel-azureUpgrade kernel-devel-rtUpgrade dtb-caviumUpgrade kernel-source-azureUpgrade kernel-64kb-develUpgrade cluster-md-kmp-rtUpgrade gfs2-kmp-rtUpgrade dlm-kmp-64kbUpgrade kernel-azure-livepatch-develUpgrade dtb-mediatekUpgrade dtb-lgUpgrade kernel-rtUpgrade kernel-azure-optionalUpgrade gfs2-kmp-defaultUpgrade kernel-kvmsmall-develUpgrade kernel-syms-azureUpgrade dtb-exynosUpgrade kernel-kvmsmallUpgrade kernel-default-vdsoUpgrade dtb-qcomUpgrade dtb-nvidiaUpgrade ocfs2-kmp-defaultUpgrade dtb-rockchipUpgrade gfs2-kmp-azureUpgrade dtb-armUpgrade dtb-amlogicUpgrade kernel-default-develUpgrade kernel-64kbUpgrade kernel-rt-vdsoUpgrade kernel-azure-extraUpgrade kernel-obs-qaUpgrade kernel-zfcpdumpUpgrade dtb-amdUpgrade kernel-debug-develUpgrade kernel-default-livepatch-develUpgrade kernel-syms-rtUpgrade kernel-defaultUpgrade kernel-default-baseUpgrade cluster-md-kmp-64kbUpgrade kernel-macrosUpgrade ocfs2-kmp-64kbUpgrade cluster-md-kmp-defaultUpgrade dlm-kmp-rtUpgrade kernel-rt_debugUpgrade kernel-rt_debug-vdsoUpgrade dtb-renesasUpgrade kselftests-kmp-defaultUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-marvellUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-azureUpgrade kernel-azure-vdsoUpgrade dtb-sprdUpgrade reiserfs-kmp-rtUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-rtUpgrade kernel-default-extraUpgrade kernel-rt-optionalUpgrade kselftests-kmp-rtUpgrade kernel-debug-vdsoUpgrade kernel-debug-livepatch-develUpgrade kernel-64kb-livepatch-develUpgrade kernel-rt-livepatch-develUpgrade dtb-freescaleUpgrade kernel-64kb-extraUpgrade dtb-appleUpgrade kernel-64kb-optionalUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-azureUpgrade dtb-broadcomUpgrade kernel-docsUpgrade kernel-debugUpgrade dtb-apmUpgrade dtb-amazonUpgrade gfs2-kmp-64kbUpgrade dtb-socionextUpgrade dlm-kmp-azureUpgrade kernel-rt_debug-develUpgrade dtb-hisiliconUpgrade kernel-default-livepatchUpgrade dlm-kmp-defaultUpgrade kernel-kvmsmall-vdsoUpgrade kernel-source-vanillaUpgrade kernel-source-rtUpgrade kernel-docs-html | Aug 9, 2024 | May 24, 2024 |
| Ubuntu | — | Upgrade linux-azure-fde-5.15No solution exists | Jun 26, 2025 | May 24, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub