In the Linux kernel, the following vulnerability has been resolved:
btrfs: zoned: do not flag ZEROOUT on non-dirty extent buffer
Btrfs clears the content of an extent buffer marked as EXTENT_BUFFER_ZONED_ZEROOUT before the bio submission. This mechanism is introduced to prevent a write hole of an extent buffer, which is once allocated, marked dirty, but turns out unnecessary and cleaned up within one transaction operation.
Currently, btrfs_clear_buffer_dirty() marks the extent buffer as EXTENT_BUFFER_ZONED_ZEROOUT, and skips the entry function. If this call happens while the buffer is under IO (with the WRITEBACK flag set, without the DIRTY flag), we can add the ZEROOUT flag and clear the buffer's content just before a bio submission. As a result:
1) it can lead to adding faulty delayed reference item which leads to a FS corrupted (EUCLEAN) error, and
2) it writes out cleared tree node on disk
The former issue is previously discussed in [1]. The corruption happens when it runs a delayed reference update. So, on-disk data is safe.
[1] https://lore.kernel.org/linux-btrfs/3f4f2a0ff1a6c818050434288925bdcf3cd719e5.1709124777.git.naohiro.aota@wdc.com/
The latter one can reach on-disk data. But, as that node is already processed by btrfs_clear_buffer_dirty(), that will be invalidated in the next transaction commit anyway. So, the chance of hitting the corruption is relatively small.
Anyway, we should skip flagging ZEROOUT on a non-DIRTY extent buffer, to keep the content under IO intact.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 30, 2024 |
| Ubuntu | — | Upgrade linux-image-virtualUpgrade linux-image-generic-lpaeUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-ibmUpgrade linux-image-raspiUpgrade linux-image-intelUpgrade linux-image-6.8.0-38-generic-64kUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1009-nvidia-64kUpgrade linux-image-genericUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1009-nvidiaUpgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1011-awsUpgrade linux-image-6.8.0-1010-gcpUpgrade linux-image-6.8.0-1010-azure-fdeUpgrade linux-image-azureUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-1010-azureUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-1008-oracle-64kUpgrade linux-image-6.8.0-38-lowlatency-64kUpgrade linux-image-6.8.0-38-genericUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1008-oracleUpgrade linux-image-6.8.0-38-lowlatencyUpgrade linux-image-kvmUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1006-gkeUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-6.8.0-1007-intelUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1007-raspiUpgrade linux-image-6.8.0-1008-oemUpgrade linux-image-gcpUpgrade linux-image-azure-fdeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1008-ibmUpgrade linux-image-awsUpgrade linux-image-ibm-lts-24.04 | Jul 12, 2024 | May 30, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub