{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2024-49932",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2024-10-21T12:17:06.040Z",
        "datePublished": "2024-10-21T18:01:54.410Z",
        "dateUpdated": "2026-08-05T11:40:31.087Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T11:40:31.087Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don't readahead the relocation inode on RST\n\nOn relocation we're doing readahead on the relocation inode, but if the\nfilesystem is backed by a RAID stripe tree we can get ENOENT (e.g. due to\npreallocated extents not being mapped in the RST) from the lookup.\n\nBut readahead doesn't handle the error and submits invalid reads to the\ndevice, causing an assertion in the scatter-gather list code:\n\n  BTRFS info (device nvme1n1): balance: start -d -m -s\n  BTRFS info (device nvme1n1): relocating block group 6480920576 flags data|raid0\n  BTRFS error (device nvme1n1): cannot find raid-stripe for logical [6481928192, 6481969152] devid 2, profile raid0\n  ------------[ cut here ]------------\n  kernel BUG at include/linux/scatterlist.h:115!\n  Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI\n  CPU: 0 PID: 1012 Comm: btrfs Not tainted 6.10.0-rc7+ #567\n  RIP: 0010:__blk_rq_map_sg+0x339/0x4a0\n  RSP: 0018:ffffc90001a43820 EFLAGS: 00010202\n  RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802\n  RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000\n  RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8\n  R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000\n  FS:  00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 000000002cd11000 CR3: 00000001109ea001 CR4: 0000000000370eb0\n  Call Trace:\n   <TASK>\n   ? __die_body.cold+0x14/0x25\n   ? die+0x2e/0x50\n   ? do_trap+0xca/0x110\n   ? do_error_trap+0x65/0x80\n   ? __blk_rq_map_sg+0x339/0x4a0\n   ? exc_invalid_op+0x50/0x70\n   ? __blk_rq_map_sg+0x339/0x4a0\n   ? asm_exc_invalid_op+0x1a/0x20\n   ? __blk_rq_map_sg+0x339/0x4a0\n   nvme_prep_rq.part.0+0x9d/0x770\n   nvme_queue_rq+0x7d/0x1e0\n   __blk_mq_issue_directly+0x2a/0x90\n   ? blk_mq_get_budget_and_tag+0x61/0x90\n   blk_mq_try_issue_list_directly+0x56/0xf0\n   blk_mq_flush_plug_list.part.0+0x52b/0x5d0\n   __blk_flush_plug+0xc6/0x110\n   blk_finish_plug+0x28/0x40\n   read_pages+0x160/0x1c0\n   page_cache_ra_unbounded+0x109/0x180\n   relocate_file_extent_cluster+0x611/0x6a0\n   ? btrfs_search_slot+0xba4/0xd20\n   ? balance_dirty_pages_ratelimited_flags+0x26/0xb00\n   relocate_data_extent.constprop.0+0x134/0x160\n   relocate_block_group+0x3f2/0x500\n   btrfs_relocate_block_group+0x250/0x430\n   btrfs_relocate_chunk+0x3f/0x130\n   btrfs_balance+0x71b/0xef0\n   ? kmalloc_trace_noprof+0x13b/0x280\n   btrfs_ioctl+0x2c2e/0x3030\n   ? kvfree_call_rcu+0x1e6/0x340\n   ? list_lru_add_obj+0x66/0x80\n   ? mntput_no_expire+0x3a/0x220\n   __x64_sys_ioctl+0x96/0xc0\n   do_syscall_64+0x54/0x110\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n  RIP: 0033:0x7fcc04514f9b\n  Code: Unable to access opcode bytes at 0x7fcc04514f71.\n  RSP: 002b:00007ffeba923370 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n  RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fcc04514f9b\n  RDX: 00007ffeba923460 RSI: 00000000c4009420 RDI: 0000000000000003\n  RBP: 0000000000000000 R08: 0000000000000013 R09: 0000000000000001\n  R10: 00007fcc043fbba8 R11: 0000000000000246 R12: 00007ffeba924fc5\n  R13: 00007ffeba923460 R14: 0000000000000002 R15: 00000000004d4bb0\n   </TASK>\n  Modules linked in:\n  ---[ end trace 0000000000000000 ]---\n  RIP: 0010:__blk_rq_map_sg+0x339/0x4a0\n  RSP: 0018:ffffc90001a43820 EFLAGS: 00010202\n  RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802\n  RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000\n  RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000\n  R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8\n  R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000\n  FS:  00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007fcc04514f71 CR3: 00000001109ea001 CR4: 0000000000370eb0\n  Kernel p\n---truncated---"
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - The vulnerable code is reached through local filesystem activity on a mounted btrfs — either the BTRFS_IOC_BALANCE ioctl or background block group reclaim triggered by local file operations. No network-facing component processes attacker data here.\nAC:H - The RAID_STRIPE_TREE incompat bit is only accepted by BTRFS_FEATURE_INCOMPAT_SUPP under CONFIG_BTRFS_DEBUG, so on any distro/production kernel btrfs_check_features() refuses the mount outright; the filesystem must additionally have been created with the experimental raid-stripe-tree feature. Both are build/deployment conditions entirely outside attacker control and rare in practice.\nPR:L - Although the reported reproducer used BTRFS_IOC_BALANCE (capable(CAP_SYS_ADMIN) in the init namespace), the identical relocate_one_folio path is entered with no privileges via automatic block group reclaim — an unprivileged user freeing extents drives btrfs_update_block_group → should_reclaim_block_group → btrfs_mark_bg_to_reclaim → btrfs_reclaim_bgs_work → btrfs_relocate_chunk, which is enabled by default on zoned filesystems (threshold 75), RST's intended deployment.\nUI:N - The affected filesystem is already mounted; relocation is triggered either by the attacker's own ioctl or by the kernel's background reclaim worker responding to the attacker's file operations. No victim action is required.\nS:U - The corruption and crash occur entirely within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unhandled ENOENT causes invalid reads to be submitted to the block device, pulling unrelated on-disk content into the relocation inode's page cache, and the crash signature (a misaligned struct page pointer reaching sg_assign_page in the NVMe DMA mapping path) shows bio/bvec memory corruption that could be leveraged for disclosure.\nI:H - Data read from the wrong device offset is written back by relocation as the replacement extent, silently corrupting user file contents, and the shared bi_io_vec between the split clone and the prematurely-ended parent bbio constitutes memory corruption usable for control-flow-relevant writes.\nA:H - The bug deterministically produces kernel BUG at include/linux/scatterlist.h:115 in __blk_rq_map_sg, reported as \"Kernel panic - not syncing: Fatal exception\" — a full system crash."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "fs/btrfs/relocation.c"
                    ],
                    "versions": [
                        {
                            "version": "10e27980f2ff66ba0c6da55f33b4814d5bc86573",
                            "lessThan": "f7a1218a983ab98aba140dc20b25f60b39ee4033",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "10e27980f2ff66ba0c6da55f33b4814d5bc86573",
                            "lessThan": "04915240e2c3a018e4c7f23418478d27226c8957",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "fs/btrfs/relocation.c"
                    ],
                    "versions": [
                        {
                            "version": "6.7",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "6.7",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.11.3",
                            "lessThanOrEqual": "6.11.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.12",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.7",
                                    "versionEndExcluding": "6.11.3"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "6.7",
                                    "versionEndExcluding": "6.12"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/f7a1218a983ab98aba140dc20b25f60b39ee4033"
                },
                {
                    "url": "https://git.kernel.org/stable/c/04915240e2c3a018e4c7f23418478d27226c8957"
                }
            ],
            "title": "btrfs: don't readahead the relocation inode on RST",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "id": "CVE-2024-49932",
                                "role": "CISA Coordinator",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "version": "2.0.3",
                                "timestamp": "2024-10-22T13:38:55.739615Z"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2024-10-22T13:48:43.075Z"
                }
            }
        ]
    }
}