Critical Vulnerability in Linux Kernel: Btrfs Error Propagation Issue
Summary
DEBIAN-CVE-2024-50225: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix error propagation of split bios The purpose of btrfs_bbio_propagate_error() shall be propagating an error of split bio to its original btrfs_... Affects linux versions < 6.11.7-1. Fixed in 6.11.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system. The Btrfs (B-tree file system) is a modern file system for Linux that offers advanced features such as snapshots, dynamic inode allocation, and integrated multi-device support. However, a recent vulnerability has been identified in the Btrfs implementation that affects error handling during bio operations, potentially leading to system crashes.
Vulnerability Detail
In the Linux kernel, specifically within the Btrfs file system, a vulnerability has been identified related to the error propagation of split bios. The function btrfs_bbio_propagate_error() is intended to propagate errors from split bios back to their original btrfs_bio. However, in certain scenarios, particularly when end_io is called quickly, the original bio context may not be correctly set, leading to a NULL pointer dereference. This can result in a kernel panic, causing the system to crash. The vulnerability is easily reproducible under specific conditions, particularly with zoned devices and certain RAID configurations.
How To Fix
Minimum fixed version
6.11.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using the Btrfs file system with RAID configurations that may trigger this vulnerability until the kernel is updated. Additionally, monitoring system logs for any unusual behavior can help in identifying potential issues early.
Conclusion
The identified vulnerability in the Linux kernel's Btrfs file system poses a significant risk, leading to potential system crashes due to improper error handling. Users are strongly encouraged to update their systems to the latest patched version to mitigate this risk. For those unable to update immediately, temporary workarounds are available, but they do not replace the need for a proper fix.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to a kernel panic, causing the system to crash and potentially resulting in data loss.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring installation.
The vulnerability affects all versions prior to 6.11.7-1 in both Debian 13 and Debian 14.
Yes, updating to the patched version of the Linux kernel (6.11.7-1) resolves the vulnerability.
If an immediate update is not possible, consider using alternative file systems or configurations that do not trigger this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
