In the Linux kernel, the following vulnerability has been resolved:
btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
If the source file descriptor to the snapshot ioctl refers to a deleted subvolume, we get the following abort:
BTRFS: Transaction aborted (error -2) WARNING: CPU: 0 PID: 833 at fs/btrfs/transaction.c:1875 create_pending_snapshot+0x1040/0x1190 [btrfs] Modules linked in: pata_acpi btrfs ata_piix libata scsi_mod virtio_net blake2b_generic xor net_failover virtio_rng failover scsi_common rng_core raid6_pq libcrc32c CPU: 0 PID: 833 Comm: t_snapshot_dele Not tainted 6.7.0-rc6 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014 RIP: 0010:create_pending_snapshot+0x1040/0x1190 [btrfs] RSP: 0018:ffffa09c01337af8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff9982053e7c78 RCX: 0000000000000027 RDX: ffff99827dc20848 RSI: 0000000000000001 RDI: ffff99827dc20840 RBP: ffffa09c01337c00 R08: 0000000000000000 R09: ffffa09c01337998 R10: 0000000000000003 R11: ffffffffb96da248 R12: fffffffffffffffe R13: ffff99820535bb28 R14: ffff99820b7bd000 R15: ffff99820381ea80 FS: 00007fe20aadabc0(0000) GS:ffff99827dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000559a120b502f CR3: 00000000055b6000 CR4: 00000000000006f0 Call Trace: <TASK> ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? __warn+0x81/0x130 ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? report_bug+0x171/0x1a0 ? handle_bug+0x3a/0x70 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? create_pending_snapshot+0x1040/0x1190 [btrfs] create_pending_snapshots+0x92/0xc0 [btrfs] btrfs_commit_transaction+0x66b/0xf40 [btrfs] btrfs_mksubvol+0x301/0x4d0 [btrfs] btrfs_mksnapshot+0x80/0xb0 [btrfs] __btrfs_ioctl_snap_create+0x1c2/0x1d0 [btrfs] btrfs_ioctl_snap_create_v2+0xc4/0x150 [btrfs] btrfs_ioctl+0x8a6/0x2650 [btrfs] ? kmem_cache_free+0x22/0x340 ? do_sys_openat2+0x97/0xe0 __x64_sys_ioctl+0x97/0xd0 do_syscall_64+0x46/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 RIP: 0033:0x7fe20abe83af RSP: 002b:00007ffe6eff1360 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007fe20abe83af RDX: 00007ffe6eff23c0 RSI: 0000000050009417 RDI: 0000000000000003 RBP: 0000000000000003 R08: 0000000000000000 R09: 00007fe20ad16cd0 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe6eff13c0 R14: 00007fe20ad45000 R15: 0000559a120b6d58 </TASK> ---[ end trace 0000000000000000 ]--- BTRFS: error (device vdc: state A) in create_pending_snapshot:1875: errno=-2 No such entry BTRFS info (device vdc: state EA): forced readonly BTRFS warning (device vdc: state EA): Skipping commit of aborted transaction. BTRFS: error (device vdc: state EA) in cleanup_transaction:2055: errno=-2 No such entry
This happens because create_pending_snapshot() initializes the new root item as a copy of the source root item. This includes the refs field, which is 0 for a deleted subvolume. The call to btrfs_insert_root() therefore inserts a root with refs == 0. btrfs_get_new_fs_root() then finds the root and returns -ENOENT if refs == 0, which causes create_pending_snapshot() to abort.
Fix it by checking the source root's refs before attempting the snapshot, but after locking subvol_sem to avoid racing with deletion.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade python-perf-debuginfoUpgrade perf-debuginfoUpgrade kernel-toolsUpgrade python-perfUpgrade kernel-livepatch-5.15.149-99.161Upgrade bpftool-debuginfoUpgrade kernel-livepatch-5.10.210-201.852Upgrade bpftoolUpgrade kernel-tools-debuginfoUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade kernel-develUpgrade kernelUpgrade kernel-debuginfo | Aug 28, 2024 | Mar 26, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-headersUpgrade kernel-libbpfUpgrade kernel-tools-develUpgrade kernel-modules-extraUpgrade python3-perfUpgrade bpftool-debuginfoUpgrade perfUpgrade perf-debuginfoUpgrade kernel-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-libbpf-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-staticUpgrade kernel-develUpgrade kernel-modules-extra-commonUpgrade bpftoolUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-6.1.77-99.164Upgrade python3-perf-debuginfoUpgrade kernel-toolsUpgrade kernel | Feb 17, 2025 | Mar 26, 2024 |
| Debian | — | Upgrade linux | May 8, 2024 | Mar 26, 2024 |
| Oracle_linux | — | Upgrade kernel-uek | Oct 14, 2025 | Mar 26, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Mar 26, 2024 |
| Suse | — | Upgrade cluster-md-kmp-azureUpgrade dtb-hisiliconUpgrade kernel-azure-develUpgrade dtb-exynosUpgrade kernel-rt-livepatch-develUpgrade dtb-freescaleUpgrade dtb-armUpgrade kernel-azure-livepatch-develUpgrade dtb-amazonUpgrade kernel-syms-azureUpgrade kernel-rtUpgrade kernel-azure-vdsoUpgrade kernel-debug-livepatch-develUpgrade kernel-rt-develUpgrade kernel-kvmsmall-develUpgrade kernel-default-optionalUpgrade dtb-qcomUpgrade kselftests-kmp-64kbUpgrade kernel-symsUpgrade kernel-devel-azureUpgrade dtb-xilinxUpgrade dlm-kmp-64kbUpgrade kernel-64kb-develUpgrade dtb-mediatekUpgrade kselftests-kmp-defaultUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-appleUpgrade kernel-zfcpdumpUpgrade kernel-azure-extraUpgrade kernel-64kb-livepatch-develUpgrade kernel-64kbUpgrade ocfs2-kmp-rtUpgrade kernel-default-develUpgrade kernel-64kb-optionalUpgrade dtb-amlogicUpgrade kernel-default-extraUpgrade kernel-macrosUpgrade dtb-amdUpgrade dlm-kmp-azureUpgrade kernel-source-azureUpgrade kernel-sourceUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-livepatchUpgrade kernel-kvmsmallUpgrade gfs2-kmp-rtUpgrade cluster-md-kmp-defaultUpgrade kernel-devel-rtUpgrade kernel-default-manUpgrade kernel-syms-rtUpgrade kernel-debugUpgrade kernel-debug-develUpgrade dtb-lgUpgrade gfs2-kmp-64kbUpgrade kernel-obs-qaUpgrade dtb-apmUpgrade dtb-broadcomUpgrade dtb-socionextUpgrade gfs2-kmp-azureUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt_debug-develUpgrade cluster-md-kmp-64kbUpgrade dtb-caviumUpgrade kernel-default-livepatchUpgrade dtb-alteraUpgrade kernel-obs-buildUpgrade ocfs2-kmp-64kbUpgrade kernel-64kb-extraUpgrade kernel-default-livepatch-develUpgrade kselftests-kmp-rtUpgrade dlm-kmp-rtUpgrade kernel-default-baseUpgrade kernel-docsUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-source-vanillaUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-vdsoUpgrade kernel-rt-extraUpgrade reiserfs-kmp-azureUpgrade ocfs2-kmp-defaultUpgrade kernel-defaultUpgrade dtb-nvidiaUpgrade kernel-develUpgrade ocfs2-kmp-azureUpgrade kselftests-kmp-azureUpgrade dtb-sprdUpgrade cluster-md-kmp-rtUpgrade kernel-default-vdsoUpgrade kernel-azure-optionalUpgrade kernel-debug-vdsoUpgrade kernel-rt_debugUpgrade dtb-marvellUpgrade dtb-renesasUpgrade kernel-default-base-rebuildUpgrade kernel-rt-optionalUpgrade kernel-azureUpgrade kernel-docs-htmlUpgrade dtb-rockchipUpgrade dtb-allwinnerUpgrade dlm-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade reiserfs-kmp-64kbUpgrade kernel-source-rtUpgrade reiserfs-kmp-rt | Jul 10, 2024 | Mar 26, 2024 |
| Ubuntu | — | Upgrade linux-image-5.15.0-1054-ibmUpgrade linux-image-5.15.0-1059-gcpUpgrade linux-image-intelUpgrade linux-image-nvidiaUpgrade linux-image-azure-lts-22.04Upgrade linux-image-oem-20.04cUpgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-gkeop-5.15Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.5.0-1021-nvidiaUpgrade linux-image-raspiUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-5.15.0-106-generic-lpaeUpgrade linux-image-oem-22.04Upgrade linux-image-6.5.0-1022-azure-fdeUpgrade linux-image-intel-iotgUpgrade linux-image-6.5.0-1015-starfiveUpgrade linux-image-5.15.0-1057-intel-iotgUpgrade linux-image-nvidia-6.5Upgrade linux-image-6.5.0-1022-azureUpgrade linux-image-5.15.0-1054-nvidia-lowlatencyUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-5.15.0-106-genericUpgrade linux-image-6.5.0-41-lowlatencyUpgrade linux-image-azureUpgrade linux-image-genericUpgrade linux-image-ibmUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-1044-gkeopUpgrade linux-image-5.15.0-106-lowlatency-64kUpgrade linux-image-starfiveUpgrade linux-image-oem-20.04dUpgrade linux-image-5.15.0-1059-oracleUpgrade linux-image-azure-fdeUpgrade linux-image-5.15.0-1058-kvmUpgrade linux-image-gkeopUpgrade linux-image-oem-22.04aUpgrade linux-image-laptop-23.10Upgrade linux-image-gcpUpgrade linux-image-generic-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-5.15.0-106-lowlatencyUpgrade linux-image-gke-5.15Upgrade linux-image-5.15.0-1063-azure-fdeUpgrade linux-image-lowlatency-64kUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-5.15.0-1058-intel-iotgUpgrade linux-image-oem-22.04bUpgrade linux-image-5.15.0-106-generic-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-6.5.0-41-genericUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-5.15.0-1054-nvidiaUpgrade linux-image-6.5.0-1024-oracleUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-lowlatencyUpgrade linux-image-oem-20.04bUpgrade linux-image-oracle-64kUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-6.5.0-1021-awsUpgrade linux-image-6.5.0-1021-nvidia-64kUpgrade linux-image-awsUpgrade linux-image-5.15.0-1054-raspiUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-oracleUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.15.0-1063-azureUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-virtualUpgrade linux-image-6.5.0-1017-laptopUpgrade linux-image-generic-lpaeUpgrade linux-image-aws-lts-22.04Upgrade linux-image-azure-cvmUpgrade linux-image-oem-20.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-kvmUpgrade linux-image-5.15.0-1061-awsUpgrade linux-image-6.5.0-41-lowlatency-64kUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-raspi-nolpaeUpgrade linux-image-6.5.0-1022-gcpUpgrade linux-image-6.5.0-1018-raspiUpgrade linux-image-6.5.0-1024-oemUpgrade linux-image-6.5.0-41-generic-64kUpgrade linux-image-5.15.0-1058-gkeUpgrade linux-image-gkeUpgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-nvidia-64k-6.5Upgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-6.5.0-1024-oracle-64k | May 17, 2024 | Mar 26, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 26, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub