In the Linux kernel, the following vulnerability has been resolved:
btrfs: zoned: allocate dummy checksums for zoned NODATASUM writes
Shin'ichiro reported that when he's running fstests' test-case btrfs/167 on emulated zoned devices, he's seeing the following NULL pointer dereference in 'btrfs_zone_finish_endio()':
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000011: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000088-0x000000000000008f] CPU: 4 PID: 2332440 Comm: kworker/u80:15 Tainted: G W 6.10.0-rc2-kts+ #4 Hardware name: Supermicro Super Server/X11SPi-TF, BIOS 3.3 02/21/2020 Workqueue: btrfs-endio-write btrfs_work_helper [btrfs] RIP: 0010:btrfs_zone_finish_endio.part.0+0x34/0x160 [btrfs]
RSP: 0018:ffff88867f107a90 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff893e5534 RDX: 0000000000000011 RSI: 0000000000000004 RDI: 0000000000000088 RBP: 0000000000000002 R08: 0000000000000001 R09: ffffed1081696028 R10: ffff88840b4b0143 R11: ffff88834dfff600 R12: ffff88840b4b0000 R13: 0000000000020000 R14: 0000000000000000 R15: ffff888530ad5210 FS: 0000000000000000(0000) GS:ffff888e3f800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f87223fff38 CR3: 00000007a7c6a002 CR4: 00000000007706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ? __die_body.cold+0x19/0x27 ? die_addr+0x46/0x70 ? exc_general_protection+0x14f/0x250 ? asm_exc_general_protection+0x26/0x30 ? do_raw_read_unlock+0x44/0x70 ? btrfs_zone_finish_endio.part.0+0x34/0x160 [btrfs] btrfs_finish_one_ordered+0x5d9/0x19a0 [btrfs] ? __pfx_lock_release+0x10/0x10 ? do_raw_write_lock+0x90/0x260 ? __pfx_do_raw_write_lock+0x10/0x10 ? __pfx_btrfs_finish_one_ordered+0x10/0x10 [btrfs] ? _raw_write_unlock+0x23/0x40 ? btrfs_finish_ordered_zoned+0x5a9/0x850 [btrfs] ? lock_acquire+0x435/0x500 btrfs_work_helper+0x1b1/0xa70 [btrfs] ? __schedule+0x10a8/0x60b0 ? __pfx___might_resched+0x10/0x10 process_one_work+0x862/0x1410 ? __pfx_lock_acquire+0x10/0x10 ? __pfx_process_one_work+0x10/0x10 ? assign_work+0x16c/0x240 worker_thread+0x5e6/0x1010 ? __pfx_worker_thread+0x10/0x10 kthread+0x2c3/0x3a0 ? trace_irq_enable.constprop.0+0xce/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK>
Enabling CONFIG_BTRFS_ASSERT revealed the following assertion to trigger:
assertion failed: !list_empty(&ordered->list), in fs/btrfs/zoned.c:1815
This indicates, that we're missing the checksums list on the ordered_extent. As btrfs/167 is doing a NOCOW write this is to be expected.
Further analysis with drgn confirmed the assumption:
>>> inode = prog.crashed_thread().stack_trace()[11]['ordered'].inode >>> btrfs_inode = drgn.container_of(inode, "struct btrfs_inode", \ "vfs_inode") >>> print(btrfs_inode.flags) (u32)1
As zoned emulation mode simulates conventional zones on regular devices, we cannot use zone-append for writing. But we're only attaching dummy checksums if we're doing a zone-append write.
So for NOCOW zoned data writes on conventional zones, also attach a dummy checksum.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 12, 2024 |
| Suse | — | Upgrade kernel-default-vdsoUpgrade kernel-rt_debug-vdsoUpgrade kernel-docsUpgrade kselftests-kmp-rtUpgrade kernel-rt-livepatch-develUpgrade kernel-rt-optionalUpgrade kernel-rtUpgrade kernel-rt-vdsoUpgrade kernel-azure-develUpgrade cluster-md-kmp-64kbUpgrade ocfs2-kmp-64kbUpgrade kernel-syms-rtUpgrade dlm-kmp-rtUpgrade kernel-azure-optionalUpgrade dtb-sprdUpgrade kernel-defaultUpgrade reiserfs-kmp-64kbUpgrade gfs2-kmp-defaultUpgrade kernel-azure-vdsoUpgrade kernel-obs-buildUpgrade gfs2-kmp-azureUpgrade kselftests-kmp-azureUpgrade kernel-kvmsmall-vdsoUpgrade dtb-alteraUpgrade kernel-64kb-extraUpgrade kernel-azure-livepatch-develUpgrade dtb-qcomUpgrade dtb-nvidiaUpgrade kernel-sourceUpgrade dtb-broadcomUpgrade reiserfs-kmp-azureUpgrade kernel-devel-azureUpgrade kernel-debug-vdsoUpgrade kernel-rt-extraUpgrade kernel-rt_debug-develUpgrade kernel-debug-livepatch-develUpgrade kernel-docs-htmlUpgrade kernel-azureUpgrade dtb-amlogicUpgrade kernel-source-rtUpgrade kernel-default-base-rebuildUpgrade dtb-marvellUpgrade dtb-rockchipUpgrade kernel-syms-azureUpgrade kernel-source-vanillaUpgrade dtb-caviumUpgrade dtb-exynosUpgrade kernel-symsUpgrade kernel-kvmsmall-develUpgrade kernel-macrosUpgrade kernel-default-optionalUpgrade kernel-kvmsmallUpgrade kernel-default-livepatchUpgrade kernel-64kb-optionalUpgrade kernel-develUpgrade kselftests-kmp-defaultUpgrade kernel-source-azureUpgrade kernel-default-develUpgrade cluster-md-kmp-azureUpgrade kernel-devel-rtUpgrade kernel-azure-extraUpgrade dtb-apmUpgrade dlm-kmp-azureUpgrade kernel-rt_debugUpgrade cluster-md-kmp-rtUpgrade kselftests-kmp-64kbUpgrade dtb-lgUpgrade ocfs2-kmp-rtUpgrade kernel-default-livepatch-develUpgrade dlm-kmp-defaultUpgrade kernel-default-extraUpgrade kernel-debug-develUpgrade dtb-allwinnerUpgrade kernel-obs-qaUpgrade dtb-armUpgrade kernel-default-baseUpgrade kernel-64kbUpgrade dtb-xilinxUpgrade reiserfs-kmp-defaultUpgrade kernel-rt-develUpgrade kernel-64kb-livepatch-develUpgrade dtb-amdUpgrade kernel-64kb-develUpgrade kernel-debugUpgrade dtb-mediatekUpgrade cluster-md-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade dlm-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade kernel-zfcpdumpUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-kvmsmall-livepatch-develUpgrade gfs2-kmp-rtUpgrade gfs2-kmp-64kbUpgrade dtb-socionextUpgrade dtb-renesasUpgrade dtb-appleUpgrade dtb-amazonUpgrade ocfs2-kmp-defaultUpgrade dtb-freescaleUpgrade dtb-hisilicon | Dec 5, 2025 | Sep 10, 2024 |
| Ubuntu | — | Upgrade linux-image-oem-22.04dUpgrade linux-image-azureUpgrade linux-image-oem-22.04bUpgrade linux-image-kvmUpgrade linux-image-generic-64kUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-awsUpgrade linux-image-6.8.0-1013-nvidia-lowlatency-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-virtualUpgrade linux-image-6.8.0-1014-azure-fdeUpgrade linux-image-6.8.0-1013-nvidia-lowlatencyUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-1014-azureUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-raspiUpgrade linux-image-6.8.0-44-lowlatency-64kUpgrade linux-image-gcpUpgrade linux-image-ibm-classicUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-oracle-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1013-nvidia-64kUpgrade linux-image-6.8.0-45-genericUpgrade linux-image-oracleUpgrade linux-image-6.8.0-1013-nvidiaUpgrade linux-image-6.8.0-1011-raspiUpgrade linux-image-lowlatencyUpgrade linux-image-6.8.0-1014-gcpUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1012-oracle-64kUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-44-generic-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-ibmUpgrade linux-image-6.8.0-1012-oemUpgrade linux-image-6.8.0-1010-gkeUpgrade linux-image-6.8.0-44-lowlatencyUpgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-45-generic-64kUpgrade linux-image-oem-22.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1015-awsUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-44-genericUpgrade linux-image-genericUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-6.8.0-1012-oracleUpgrade linux-image-oem-22.04aUpgrade linux-image-nvidiaUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1012-ibm | Sep 12, 2024 | Jul 12, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub