GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-35798 (GCVE-0-2024-35798)

Vulnerability from cvelistv5 – Published: 2024-05-17 13:23 – Updated: 2026-08-05 11:30
VLAI
Title
btrfs: fix race in read_extent_buffer_pages()
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race in read_extent_buffer_pages() There are reports from tree-checker that detects corrupted nodes, without any obvious pattern so possibly an overwrite in memory. After some debugging it turns out there's a race when reading an extent buffer the uptodate status can be missed. To prevent concurrent reads for the same extent buffer, read_extent_buffer_pages() performs these checks: /* (1) */ if (test_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags)) return 0; /* (2) */ if (test_and_set_bit(EXTENT_BUFFER_READING, &eb->bflags)) goto done; At this point, it seems safe to start the actual read operation. Once that completes, end_bbio_meta_read() does /* (3) */ set_extent_buffer_uptodate(eb); /* (4) */ clear_bit(EXTENT_BUFFER_READING, &eb->bflags); Normally, this is enough to ensure only one read happens, and all other callers wait for it to finish before returning. Unfortunately, there is a racey interleaving: Thread A | Thread B | Thread C ---------+----------+--------- (1) | | | (1) | (2) | | (3) | | (4) | | | (2) | | | (1) When this happens, thread B kicks of an unnecessary read. Worse, thread C will see UPTODATE set and return immediately, while the read from thread B is still in progress. This race could result in tree-checker errors like this as the extent buffer is concurrently modified: BTRFS critical (device dm-0): corrupted node, root=256 block=8550954455682405139 owner mismatch, have 11858205567642294356 expect [256, 18446744073709551360] Fix it by testing UPTODATE again after setting the READING bit, and if it's been set, skip the unnecessary read. [ minor update of changelog ]
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-06-12 15:26 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d7172f52e9933b6ec9305e7fe6e829e3939dba04 , < 0427c8ef8bbb7f304de42ef51d69c960e165e052 (git)
Affected: d7172f52e9933b6ec9305e7fe6e829e3939dba04 , < 3a25878a3378adce5d846300c9570f15aa7f7a80 (git)
Affected: d7172f52e9933b6ec9305e7fe6e829e3939dba04 , < 2885d54af2c2e1d910e20d5c8045bae40e02fbc1 (git)
Affected: d7172f52e9933b6ec9305e7fe6e829e3939dba04 , < ef1e68236b9153c27cb7cf29ead0c532870d4215 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.5
Unaffected: 0 , < 6.5 (semver)
Unaffected: 6.6.24 , ≤ 6.6.* (semver)
Unaffected: 6.7.12 , ≤ 6.7.* (semver)
Unaffected: 6.8.3 , ≤ 6.8.* (semver)
Unaffected: 6.9 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-35798",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-12T15:26:19.488238Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-12T15:26:30.636Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:21:47.569Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/0427c8ef8bbb7f304de42ef51d69c960e165e052"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3a25878a3378adce5d846300c9570f15aa7f7a80"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/2885d54af2c2e1d910e20d5c8045bae40e02fbc1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ef1e68236b9153c27cb7cf29ead0c532870d4215"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/extent_io.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0427c8ef8bbb7f304de42ef51d69c960e165e052",
              "status": "affected",
              "version": "d7172f52e9933b6ec9305e7fe6e829e3939dba04",
              "versionType": "git"
            },
            {
              "lessThan": "3a25878a3378adce5d846300c9570f15aa7f7a80",
              "status": "affected",
              "version": "d7172f52e9933b6ec9305e7fe6e829e3939dba04",
              "versionType": "git"
            },
            {
              "lessThan": "2885d54af2c2e1d910e20d5c8045bae40e02fbc1",
              "status": "affected",
              "version": "d7172f52e9933b6ec9305e7fe6e829e3939dba04",
              "versionType": "git"
            },
            {
              "lessThan": "ef1e68236b9153c27cb7cf29ead0c532870d4215",
              "status": "affected",
              "version": "d7172f52e9933b6ec9305e7fe6e829e3939dba04",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/extent_io.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.5"
            },
            {
              "lessThan": "6.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.24",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.12",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.3",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9",
                  "versionStartIncluding": "6.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix race in read_extent_buffer_pages()\n\nThere are reports from tree-checker that detects corrupted nodes,\nwithout any obvious pattern so possibly an overwrite in memory.\nAfter some debugging it turns out there\u0027s a race when reading an extent\nbuffer the uptodate status can be missed.\n\nTo prevent concurrent reads for the same extent buffer,\nread_extent_buffer_pages() performs these checks:\n\n    /* (1) */\n    if (test_bit(EXTENT_BUFFER_UPTODATE, \u0026eb-\u003ebflags))\n        return 0;\n\n    /* (2) */\n    if (test_and_set_bit(EXTENT_BUFFER_READING, \u0026eb-\u003ebflags))\n        goto done;\n\nAt this point, it seems safe to start the actual read operation. Once\nthat completes, end_bbio_meta_read() does\n\n    /* (3) */\n    set_extent_buffer_uptodate(eb);\n\n    /* (4) */\n    clear_bit(EXTENT_BUFFER_READING, \u0026eb-\u003ebflags);\n\nNormally, this is enough to ensure only one read happens, and all other\ncallers wait for it to finish before returning.  Unfortunately, there is\na racey interleaving:\n\n    Thread A | Thread B | Thread C\n    ---------+----------+---------\n       (1)   |          |\n             |    (1)   |\n       (2)   |          |\n       (3)   |          |\n       (4)   |          |\n             |    (2)   |\n             |          |    (1)\n\nWhen this happens, thread B kicks of an unnecessary read. Worse, thread\nC will see UPTODATE set and return immediately, while the read from\nthread B is still in progress.  This race could result in tree-checker\nerrors like this as the extent buffer is concurrently modified:\n\n    BTRFS critical (device dm-0): corrupted node, root=256\n    block=8550954455682405139 owner mismatch, have 11858205567642294356\n    expect [256, 18446744073709551360]\n\nFix it by testing UPTODATE again after setting the READING bit, and if\nit\u0027s been set, skip the unnecessary read.\n\n[ minor update of changelog ]"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached through ordinary filesystem syscalls (open/stat/read/readdir/write) against a locally mounted btrfs filesystem. No network protocol handler is involved, so this requires local system access.\nAC:L - The attacker controls every side of the race \u2014 multiple threads performing concurrent lookups of the same cold metadata block, with readahead supplying the WAIT_NONE submitter \u2014 and can retry indefinitely while adding memory and CPU pressure to widen the window. The race is known to trigger spontaneously in production without any attacker.\nPR:L - Any unprivileged local user with read access to a mounted btrfs filesystem can drive concurrent metadata reads of the same extent buffer; btrfs is the default root filesystem on several major distributions. No capability, ioctl, mount privilege, or namespace trick is needed.\nUI:N - The attacker triggers the race entirely with its own file I/O against an already-mounted filesystem. No victim action or cooperation is required.\nS:U - The corruption occurs within kernel memory and on-disk metadata managed by the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - Threads consume extent-buffer contents while DMA concurrently overwrites them, yielding torn header/item fields; garbage node blockptrs and nritems drive reads of arbitrary logical addresses, and the resulting heap out-of-bounds access on struct btrfs_path is leverageable for kernel memory disclosure.\nI:H - btrfs_search_slot() writes p-\u003enodes[level] and p-\u003eslots[level] with an unvalidated 8-bit level taken from the racing memory, giving an out-of-bounds write of a kernel pointer past a kmalloc\u0027d btrfs_path; separately, a leaf modified under an in-flight overwrite is checksummed and written back, causing persistent on-disk metadata corruption.\nA:H - The documented outcome is tree-checker \"corrupted node\" reports leading to -EUCLEAN and transaction abort with the filesystem forced read-only, and the out-of-bounds writes and garbage tree traversal readily produce ASSERT/BUG_ON hits and kernel oopses."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:30:01.532Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0427c8ef8bbb7f304de42ef51d69c960e165e052"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a25878a3378adce5d846300c9570f15aa7f7a80"
        },
        {
          "url": "https://git.kernel.org/stable/c/2885d54af2c2e1d910e20d5c8045bae40e02fbc1"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef1e68236b9153c27cb7cf29ead0c532870d4215"
        }
      ],
      "title": "btrfs: fix race in read_extent_buffer_pages()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-35798",
    "datePublished": "2024-05-17T13:23:08.868Z",
    "dateReserved": "2024-05-17T12:19:12.341Z",
    "dateUpdated": "2026-08-05T11:30:01.532Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-35798",
      "date": "2026-09-14",
      "epss": "0.00179",
      "percentile": "0.07562"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-35798\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-17T14:15:12.170\",\"lastModified\":\"2026-08-04T11:17:54.100\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix race in read_extent_buffer_pages()\\n\\nThere are reports from tree-checker that detects corrupted nodes,\\nwithout any obvious pattern so possibly an overwrite in memory.\\nAfter some debugging it turns out there\u0027s a race when reading an extent\\nbuffer the uptodate status can be missed.\\n\\nTo prevent concurrent reads for the same extent buffer,\\nread_extent_buffer_pages() performs these checks:\\n\\n    /* (1) */\\n    if (test_bit(EXTENT_BUFFER_UPTODATE, \u0026eb-\u003ebflags))\\n        return 0;\\n\\n    /* (2) */\\n    if (test_and_set_bit(EXTENT_BUFFER_READING, \u0026eb-\u003ebflags))\\n        goto done;\\n\\nAt this point, it seems safe to start the actual read operation. Once\\nthat completes, end_bbio_meta_read() does\\n\\n    /* (3) */\\n    set_extent_buffer_uptodate(eb);\\n\\n    /* (4) */\\n    clear_bit(EXTENT_BUFFER_READING, \u0026eb-\u003ebflags);\\n\\nNormally, this is enough to ensure only one read happens, and all other\\ncallers wait for it to finish before returning.  Unfortunately, there is\\na racey interleaving:\\n\\n    Thread A | Thread B | Thread C\\n    ---------+----------+---------\\n       (1)   |          |\\n             |    (1)   |\\n       (2)   |          |\\n       (3)   |          |\\n       (4)   |          |\\n             |    (2)   |\\n             |          |    (1)\\n\\nWhen this happens, thread B kicks of an unnecessary read. Worse, thread\\nC will see UPTODATE set and return immediately, while the read from\\nthread B is still in progress.  This race could result in tree-checker\\nerrors like this as the extent buffer is concurrently modified:\\n\\n    BTRFS critical (device dm-0): corrupted node, root=256\\n    block=8550954455682405139 owner mismatch, have 11858205567642294356\\n    expect [256, 18446744073709551360]\\n\\nFix it by testing UPTODATE again after setting the READING bit, and if\\nit\u0027s been set, skip the unnecessary read.\\n\\n[ minor update of changelog ]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: corrige la ejecuci\u00f3n en read_extent_buffer_pages() Hay informes de tree-checker que detecta nodos corruptos, sin ning\u00fan patr\u00f3n obvio por lo que posiblemente se sobrescriba en la memoria. Despu\u00e9s de un poco de depuraci\u00f3n, resulta que hay una ejecuci\u00f3n cuando al leer un b\u00fafer de extensi\u00f3n se puede perder el estado de actualizaci\u00f3n. Para evitar lecturas simult\u00e1neas para el mismo b\u00fafer de extensi\u00f3n, read_extent_buffer_pages() realiza estas comprobaciones: /* (1) */ if (test_bit(EXTENT_BUFFER_UPTODATE, \u0026amp;eb-\u0026gt;bflags)) return 0; /* (2) */ if (test_and_set_bit(EXTENT_BUFFER_READING, \u0026amp;eb-\u0026gt;bflags)) ir a listo; En este punto, parece seguro iniciar la operaci\u00f3n de lectura real. Una vez que se completa, end_bbio_meta_read() hace /* (3) */ set_extent_buffer_uptodate(eb); /* (4) */ clear_bit(EXTENT_BUFFER_READING, \u0026amp;eb-\u0026gt;bflags); Normalmente, esto es suficiente para garantizar que solo se realice una lectura y que todos los dem\u00e1s llamantes esperen a que finalice antes de regresar. Desafortunadamente, hay un entrelazado racial: Hilo A | Hilo B | Rosca C ---------+----------+----------------- (1) | | | (1) | (2) | | (3) | | (4) | | | (2) | | | (1) Cuando esto sucede, el hilo B inicia una lectura innecesaria. Peor a\u00fan, el subproceso C ver\u00e1 la ACTUALIZACI\u00d3N configurada y regresar\u00e1 inmediatamente, mientras la lectura del subproceso B a\u00fan est\u00e1 en progreso. Esta ejecuci\u00f3n podr\u00eda dar como resultado errores del comprobador de \u00e1rbol como este, ya que el b\u00fafer de extensi\u00f3n se modifica simult\u00e1neamente: BTRFS cr\u00edtico (dispositivo dm-0): nodo da\u00f1ado, ra\u00edz=256 bloque=8550954455682405139 el propietario no coincide, tiene 11858205567642294356 expect [256, 18446744073709551360] Arreglarlo probando UPTODATE nuevamente despu\u00e9s de configurar el bit de LECTURA y, si se ha configurado, omita la lectura innecesaria. [actualizaci\u00f3n menor del registro de cambios]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/btrfs/extent_io.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d7172f52e9933b6ec9305e7fe6e829e3939dba04\",\"lessThan\":\"0427c8ef8bbb7f304de42ef51d69c960e165e052\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7172f52e9933b6ec9305e7fe6e829e3939dba04\",\"lessThan\":\"3a25878a3378adce5d846300c9570f15aa7f7a80\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7172f52e9933b6ec9305e7fe6e829e3939dba04\",\"lessThan\":\"2885d54af2c2e1d910e20d5c8045bae40e02fbc1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7172f52e9933b6ec9305e7fe6e829e3939dba04\",\"lessThan\":\"ef1e68236b9153c27cb7cf29ead0c532870d4215\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/btrfs/extent_io.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.5\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.5\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.24\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.12\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8.3\",\"lessThanOrEqual\":\"6.8.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.9\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-12T15:26:19.488238Z\",\"id\":\"CVE-2024-35798\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.5\",\"versionEndExcluding\":\"6.6.24\",\"matchCriteriaId\":\"A2469D58-C2A6-4C9E-9A71-83830808C4FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.12\",\"matchCriteriaId\":\"6BE9771A-BAFD-4624-95F9-58D536540C53\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.8\",\"versionEndExcluding\":\"6.8.3\",\"matchCriteriaId\":\"4C59BBC3-6495-4A77-9C82-55EC7CDF5E02\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22BEDD49-2C6D-402D-9DBF-6646F6ECD10B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0427c8ef8bbb7f304de42ef51d69c960e165e052\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2885d54af2c2e1d910e20d5c8045bae40e02fbc1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3a25878a3378adce5d846300c9570f15aa7f7a80\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ef1e68236b9153c27cb7cf29ead0c532870d4215\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/0427c8ef8bbb7f304de42ef51d69c960e165e052\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2885d54af2c2e1d910e20d5c8045bae40e02fbc1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3a25878a3378adce5d846300c9570f15aa7f7a80\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ef1e68236b9153c27cb7cf29ead0c532870d4215\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:07:37+00:00",
      "cve": "CVE-2024-35798",
      "id": "CVE-2024-35798",
      "initial_release_date": "2024-05-17T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: btrfs: fix race in read_extent_buffer_pages()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-35798.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/0427c8ef8bbb7f304de42ef51d69c960e165e052\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/3a25878a3378adce5d846300c9570f15aa7f7a80\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/2885d54af2c2e1d910e20d5c8045bae40e02fbc1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/ef1e68236b9153c27cb7cf29ead0c532870d4215\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:21:47.569Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-35798\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-12T15:26:19.488238Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-12T15:26:27.214Z\"}}], \"cna\": {\"title\": \"btrfs: fix race in read_extent_buffer_pages()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is reached through ordinary filesystem syscalls (open/stat/read/readdir/write) against a locally mounted btrfs filesystem. No network protocol handler is involved, so this requires local system access.\\nAC:L - The attacker controls every side of the race \\u2014 multiple threads performing concurrent lookups of the same cold metadata block, with readahead supplying the WAIT_NONE submitter \\u2014 and can retry indefinitely while adding memory and CPU pressure to widen the window. The race is known to trigger spontaneously in production without any attacker.\\nPR:L - Any unprivileged local user with read access to a mounted btrfs filesystem can drive concurrent metadata reads of the same extent buffer; btrfs is the default root filesystem on several major distributions. No capability, ioctl, mount privilege, or namespace trick is needed.\\nUI:N - The attacker triggers the race entirely with its own file I/O against an already-mounted filesystem. No victim action or cooperation is required.\\nS:U - The corruption occurs within kernel memory and on-disk metadata managed by the same kernel security authority. No VM, IOMMU, or sandbox boundary is crossed.\\nC:H - Threads consume extent-buffer contents while DMA concurrently overwrites them, yielding torn header/item fields; garbage node blockptrs and nritems drive reads of arbitrary logical addresses, and the resulting heap out-of-bounds access on struct btrfs_path is leverageable for kernel memory disclosure.\\nI:H - btrfs_search_slot() writes p-\u003enodes[level] and p-\u003eslots[level] with an unvalidated 8-bit level taken from the racing memory, giving an out-of-bounds write of a kernel pointer past a kmalloc\u0027d btrfs_path; separately, a leaf modified under an in-flight overwrite is checksummed and written back, causing persistent on-disk metadata corruption.\\nA:H - The documented outcome is tree-checker \\\"corrupted node\\\" reports leading to -EUCLEAN and transaction abort with the filesystem forced read-only, and the out-of-bounds writes and garbage tree traversal readily produce ASSERT/BUG_ON hits and kernel oopses.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"d7172f52e9933b6ec9305e7fe6e829e3939dba04\", \"lessThan\": \"0427c8ef8bbb7f304de42ef51d69c960e165e052\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d7172f52e9933b6ec9305e7fe6e829e3939dba04\", \"lessThan\": \"3a25878a3378adce5d846300c9570f15aa7f7a80\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d7172f52e9933b6ec9305e7fe6e829e3939dba04\", \"lessThan\": \"2885d54af2c2e1d910e20d5c8045bae40e02fbc1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d7172f52e9933b6ec9305e7fe6e829e3939dba04\", \"lessThan\": \"ef1e68236b9153c27cb7cf29ead0c532870d4215\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/btrfs/extent_io.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.5\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.5\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.24\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/btrfs/extent_io.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/0427c8ef8bbb7f304de42ef51d69c960e165e052\"}, {\"url\": \"https://git.kernel.org/stable/c/3a25878a3378adce5d846300c9570f15aa7f7a80\"}, {\"url\": \"https://git.kernel.org/stable/c/2885d54af2c2e1d910e20d5c8045bae40e02fbc1\"}, {\"url\": \"https://git.kernel.org/stable/c/ef1e68236b9153c27cb7cf29ead0c532870d4215\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix race in read_extent_buffer_pages()\\n\\nThere are reports from tree-checker that detects corrupted nodes,\\nwithout any obvious pattern so possibly an overwrite in memory.\\nAfter some debugging it turns out there\u0027s a race when reading an extent\\nbuffer the uptodate status can be missed.\\n\\nTo prevent concurrent reads for the same extent buffer,\\nread_extent_buffer_pages() performs these checks:\\n\\n    /* (1) */\\n    if (test_bit(EXTENT_BUFFER_UPTODATE, \u0026eb-\u003ebflags))\\n        return 0;\\n\\n    /* (2) */\\n    if (test_and_set_bit(EXTENT_BUFFER_READING, \u0026eb-\u003ebflags))\\n        goto done;\\n\\nAt this point, it seems safe to start the actual read operation. Once\\nthat completes, end_bbio_meta_read() does\\n\\n    /* (3) */\\n    set_extent_buffer_uptodate(eb);\\n\\n    /* (4) */\\n    clear_bit(EXTENT_BUFFER_READING, \u0026eb-\u003ebflags);\\n\\nNormally, this is enough to ensure only one read happens, and all other\\ncallers wait for it to finish before returning.  Unfortunately, there is\\na racey interleaving:\\n\\n    Thread A | Thread B | Thread C\\n    ---------+----------+---------\\n       (1)   |          |\\n             |    (1)   |\\n       (2)   |          |\\n       (3)   |          |\\n       (4)   |          |\\n             |    (2)   |\\n             |          |    (1)\\n\\nWhen this happens, thread B kicks of an unnecessary read. Worse, thread\\nC will see UPTODATE set and return immediately, while the read from\\nthread B is still in progress.  This race could result in tree-checker\\nerrors like this as the extent buffer is concurrently modified:\\n\\n    BTRFS critical (device dm-0): corrupted node, root=256\\n    block=8550954455682405139 owner mismatch, have 11858205567642294356\\n    expect [256, 18446744073709551360]\\n\\nFix it by testing UPTODATE again after setting the READING bit, and if\\nit\u0027s been set, skip the unnecessary read.\\n\\n[ minor update of changelog ]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.24\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.12\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.3\", \"versionStartIncluding\": \"6.5\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9\", \"versionStartIncluding\": \"6.5\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:30:01.532Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-35798\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:30:01.532Z\", \"dateReserved\": \"2024-05-17T12:19:12.341Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-17T13:23:08.868Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.