PT-2024-8011 · Linux+5 · Linux Kernel+5
David Sterba
·
Published
2024-08-27
·
Updated
2025-09-29
·
CVE-2024-46687
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.48/6.10.7
Description
A use-after-free vulnerability has been identified in the Linux kernel's btrfs file system, specifically in the
btrfs submit chunk() function. This vulnerability can be triggered when the kernel encounters an error while processing a read bio, leading to a double-freeing of memory and potentially causing a use-after-free condition. The vulnerability is caused by the btrfs bio end io() function calling the original endio function, which frees the whole bio, and then later calling the original endio function again, causing a double freeing.Recommendations
To resolve this issue, update the Linux kernel to a version that includes the fix for this vulnerability, which is versions 6.6.48/6.10.7 or later. As a temporary workaround, consider disabling the
btrfs submit chunk() function until a patch is available. However, this workaround may have significant performance implications and should be used with caution.Exploit
Fix
Use After Free
Double Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu