{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-46734", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-09-11T15:12:18.257Z", "datePublished": "2024-09-18T07:11:56.361Z", "dateUpdated": "2026-08-05T11:38:11.716Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:38:11.716Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix race between direct IO write and fsync when using same fd\n\nIf we have 2 threads that are using the same file descriptor and one of\nthem is doing direct IO writes while the other is doing fsync, we have a\nrace where we can end up either:\n\n1) Attempt a fsync without holding the inode's lock, triggering an\n assertion failures when assertions are enabled;\n\n2) Do an invalid memory access from the fsync task because the file private\n points to memory allocated on stack by the direct IO task and it may be\n used by the fsync task after the stack was destroyed.\n\nThe race happens like this:\n\n1) A user space program opens a file descriptor with O_DIRECT;\n\n2) The program spawns 2 threads using libpthread for example;\n\n3) One of the threads uses the file descriptor to do direct IO writes,\n while the other calls fsync using the same file descriptor.\n\n4) Call task A the thread doing direct IO writes and task B the thread\n doing fsyncs;\n\n5) Task A does a direct IO write, and at btrfs_direct_write() sets the\n file's private to an on stack allocated private with the member\n 'fsync_skip_inode_lock' set to true;\n\n6) Task B enters btrfs_sync_file() and sees that there's a private\n structure associated to the file which has 'fsync_skip_inode_lock' set\n to true, so it skips locking the inode's VFS lock;\n\n7) Task A completes the direct IO write, and resets the file's private to\n NULL since it had no prior private and our private was stack allocated.\n Then it unlocks the inode's VFS lock;\n\n8) Task B enters btrfs_get_ordered_extents_for_logging(), then the\n assertion that checks the inode's VFS lock is held fails, since task B\n never locked it and task A has already unlocked it.\n\nThe stack trace produced is the following:\n\n assertion failed: inode_is_locked(&inode->vfs_inode), in fs/btrfs/ordered-data.c:983\n ------------[ cut here ]------------\n kernel BUG at fs/btrfs/ordered-data.c:983!\n Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI\n CPU: 9 PID: 5072 Comm: worker Tainted: G U OE 6.10.5-1-default #1 openSUSE Tumbleweed 69f48d427608e1c09e60ea24c6c55e2ca1b049e8\n Hardware name: Acer Predator PH315-52/Covini_CFS, BIOS V1.12 07/28/2020\n RIP: 0010:btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs]\n Code: 50 d6 86 c0 e8 (...)\n RSP: 0018:ffff9e4a03dcfc78 EFLAGS: 00010246\n RAX: 0000000000000054 RBX: ffff9078a9868e98 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: ffff907dce4a7800 RDI: ffff907dce4a7800\n RBP: ffff907805518800 R08: 0000000000000000 R09: ffff9e4a03dcfb38\n R10: ffff9e4a03dcfb30 R11: 0000000000000003 R12: ffff907684ae7800\n R13: 0000000000000001 R14: ffff90774646b600 R15: 0000000000000000\n FS: 00007f04b96006c0(0000) GS:ffff907dce480000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f32acbfc000 CR3: 00000001fd4fa005 CR4: 00000000003726f0\n Call Trace:\n \n ? __die_body.cold+0x14/0x24\n ? die+0x2e/0x50\n ? do_trap+0xca/0x110\n ? do_error_trap+0x6a/0x90\n ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a]\n ? exc_invalid_op+0x50/0x70\n ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a]\n ? asm_exc_invalid_op+0x1a/0x20\n ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a]\n ? btrfs_get_ordered_extents_for_logging.cold+0x1f/0x42 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a]\n btrfs_sync_file+0x21a/0x4d0 [btrfs bb26272d49b4cdc847cf3f7faadd459b62caee9a]\n ? __seccomp_filter+0x31d/0x4f0\n __x64_sys_fdatasync+0x4f/0x90\n do_syscall_64+0x82/0x160\n ? do_futex+0xcb/0x190\n ? __x64_sys_futex+0x10e/0x1d0\n ? switch_fpu_return+0x4f/0xd0\n ? syscall_exit_to_user_mode+0x72/0x220\n ? do_syscall_64+0x8e/0x160\n ? syscall_exit_to_user_mod\n---truncated---" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The race is driven purely through local syscalls (`open(O_DIRECT)`, `pwrite`, `fsync`/`fdatasync`, `lseek`) on a file residing on a mounted btrfs filesystem. No network or physical access is involved.\nAC:L - The attacker controls both sides of the race by spawning its own threads on a shared file descriptor; the upstream reproducer triggers the crash \"usually within less than 1 second\" and it was independently hit by ordinary QEMU workloads and syzbot. No condition outside the attacker's control is required.\nPR:L - Any unprivileged local user with write access to a single file on a btrfs mount (default root filesystem on Fedora/openSUSE/SLE, common for container and NAS storage) can trigger it — no capabilities, root, or special mount options are needed.\nUI:N - The attacking process performs all steps itself in a tight two-thread loop; no victim action of any kind is required.\nS:U - The flaw and its impact are both confined to the kernel's own security authority; no VM, IOMMU, or hypervisor boundary is crossed.\nC:H - fsync proceeds through the full inode-logging path without the inode's i_rwsem, producing log-tree state with file extent items pointing to unwritten extents and no checksums, so post-replay reads return stale on-disk data belonging to other/deleted files; additionally the stale stack pointer allows reading another task's kernel stack contents.\nI:H - A second concurrent O_DIRECT writer and the lseek path both write through the dangling pointer into a destroyed kernel stack frame (a byte flag, and an `extent_state *` via `&private->llseek_cached_state`), and `btrfs_release_file()` can kfree/free_extent_state stale pointers — memory corruption usable for control-flow hijack — alongside unlocked concurrent modification of the log tree corrupting on-disk metadata.\nA:H - The primary observed effect is a hard kernel BUG()/panic at `fs/btrfs/ordered-data.c:983` (\"kernel BUG ... Oops: invalid opcode\"), reproducible within a second by an unprivileged process, giving a reliable full system denial of service." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/btrfs/ctree.h", "fs/btrfs/direct-io.c", "fs/btrfs/file.c", "fs/btrfs/transaction.h" ], "versions": [ { "version": "4e17707035a65f6e5b2a4d987a308cf8ed8c5ad1", "lessThan": "d116a0b0e02f395cedfb8c725bd67480aa7c428c", "status": "affected", "versionType": "git" }, { "version": "6cae8d04d8b3d1ecfadcaa989e673f6f73349ed5", "lessThan": "cd3087582e4fa36e89be4e6f859e75a4400292b4", "status": "affected", "versionType": "git" }, { "version": "0a108bde616a7017653385b5a12111015051a294", "lessThan": "7b5595f33c3c273613b590892a578d78186bb400", "status": "affected", "versionType": "git" }, { "version": "3831170f740685fddc8f6aa57a83ad0fef4711bf", "lessThan": "01681aa609b5f110502f56c4e3b2938efcf4a5bc", "status": "affected", "versionType": "git" }, { "version": "939b656bc8ab203fdbde26ccac22bcb7f0985be5", "lessThan": "cd9253c23aedd61eb5ff11f37a36247cd46faf86", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/btrfs/ctree.h", "fs/btrfs/direct-io.c", "fs/btrfs/file.c", "fs/btrfs/transaction.h" ], "versions": [ { "version": "5.15.165", "lessThan": "5.15.167", "status": "affected", "versionType": "semver" }, { "version": "6.1.105", "lessThan": "6.1.110", "status": "affected", "versionType": "semver" }, { "version": "6.6.46", "lessThan": "6.6.51", "status": "affected", "versionType": "semver" }, { "version": "6.10.5", "lessThan": "6.10.10", "status": "affected", "versionType": "semver" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.165", "versionEndExcluding": "5.15.167" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.105", "versionEndExcluding": "6.1.110" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.46", "versionEndExcluding": "6.6.51" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10.5", "versionEndExcluding": "6.10.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/d116a0b0e02f395cedfb8c725bd67480aa7c428c" }, { "url": "https://git.kernel.org/stable/c/cd3087582e4fa36e89be4e6f859e75a4400292b4" }, { "url": "https://git.kernel.org/stable/c/7b5595f33c3c273613b590892a578d78186bb400" }, { "url": "https://git.kernel.org/stable/c/01681aa609b5f110502f56c4e3b2938efcf4a5bc" }, { "url": "https://git.kernel.org/stable/c/cd9253c23aedd61eb5ff11f37a36247cd46faf86" } ], "title": "btrfs: fix race between direct IO write and fsync when using same fd", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2024-09-29T14:53:19.995108Z", "id": "CVE-2024-46734", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-29T14:53:34.279Z" } }, { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:17:16.228Z" } } ] } }