{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-26792", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-02-19T14:20:24.178Z", "datePublished": "2024-04-04T08:20:23.075Z", "dateUpdated": "2026-08-05T11:27:16.252Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:27:16.252Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix double free of anonymous device after snapshot creation failure\n\nWhen creating a snapshot we may do a double free of an anonymous device\nin case there's an error committing the transaction. The second free may\nresult in freeing an anonymous device number that was allocated by some\nother subsystem in the kernel or another btrfs filesystem.\n\nThe steps that lead to this:\n\n1) At ioctl.c:create_snapshot() we allocate an anonymous device number\n and assign it to pending_snapshot->anon_dev;\n\n2) Then we call btrfs_commit_transaction() and end up at\n transaction.c:create_pending_snapshot();\n\n3) There we call btrfs_get_new_fs_root() and pass it the anonymous device\n number stored in pending_snapshot->anon_dev;\n\n4) btrfs_get_new_fs_root() frees that anonymous device number because\n btrfs_lookup_fs_root() returned a root - someone else did a lookup\n of the new root already, which could some task doing backref walking;\n\n5) After that some error happens in the transaction commit path, and at\n ioctl.c:create_snapshot() we jump to the 'fail' label, and after\n that we free again the same anonymous device number, which in the\n meanwhile may have been reallocated somewhere else, because\n pending_snapshot->anon_dev still has the same value as in step 1.\n\nRecently syzbot ran into this and reported the following trace:\n\n ------------[ cut here ]------------\n ida_free called for id=51 which is not allocated.\n WARNING: CPU: 1 PID: 31038 at lib/idr.c:525 ida_free+0x370/0x420 lib/idr.c:525\n Modules linked in:\n CPU: 1 PID: 31038 Comm: syz-executor.2 Not tainted 6.8.0-rc4-syzkaller-00410-gc02197fc9076 #0\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024\n RIP: 0010:ida_free+0x370/0x420 lib/idr.c:525\n Code: 10 42 80 3c 28 (...)\n RSP: 0018:ffffc90015a67300 EFLAGS: 00010246\n RAX: be5130472f5dd000 RBX: 0000000000000033 RCX: 0000000000040000\n RDX: ffffc90009a7a000 RSI: 000000000003ffff RDI: 0000000000040000\n RBP: ffffc90015a673f0 R08: ffffffff81577992 R09: 1ffff92002b4cdb4\n R10: dffffc0000000000 R11: fffff52002b4cdb5 R12: 0000000000000246\n R13: dffffc0000000000 R14: ffffffff8e256b80 R15: 0000000000000246\n FS: 00007fca3f4b46c0(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f167a17b978 CR3: 000000001ed26000 CR4: 0000000000350ef0\n Call Trace:\n \n btrfs_get_root_ref+0xa48/0xaf0 fs/btrfs/disk-io.c:1346\n create_pending_snapshot+0xff2/0x2bc0 fs/btrfs/transaction.c:1837\n create_pending_snapshots+0x195/0x1d0 fs/btrfs/transaction.c:1931\n btrfs_commit_transaction+0xf1c/0x3740 fs/btrfs/transaction.c:2404\n create_snapshot+0x507/0x880 fs/btrfs/ioctl.c:848\n btrfs_mksubvol+0x5d0/0x750 fs/btrfs/ioctl.c:998\n btrfs_mksnapshot+0xb5/0xf0 fs/btrfs/ioctl.c:1044\n __btrfs_ioctl_snap_create+0x387/0x4b0 fs/btrfs/ioctl.c:1306\n btrfs_ioctl_snap_create_v2+0x1ca/0x400 fs/btrfs/ioctl.c:1393\n btrfs_ioctl+0xa74/0xd40\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:871 [inline]\n __se_sys_ioctl+0xfe/0x170 fs/ioctl.c:857\n do_syscall_64+0xfb/0x240\n entry_SYSCALL_64_after_hwframe+0x6f/0x77\n RIP: 0033:0x7fca3e67dda9\n Code: 28 00 00 00 (...)\n RSP: 002b:00007fca3f4b40c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n RAX: ffffffffffffffda RBX: 00007fca3e7abf80 RCX: 00007fca3e67dda9\n RDX: 00000000200005c0 RSI: 0000000050009417 RDI: 0000000000000003\n RBP: 00007fca3e6ca47a R08: 0000000000000000 R09: 0000000000000000\n R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\n R13: 000000000000000b R14: 00007fca3e7abf80 R15: 00007fff6bf95658\n \n\nWhere we get an explicit message where we attempt to free an anonymous\ndevice number that is not currently allocated. It happens in a different\ncode path from the example below, at btrfs_get_root_ref(), so this change\nmay not fix the case triggered by sy\n---truncated---" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached only through the `BTRFS_IOC_SNAP_CREATE`/`SNAP_CREATE_V2` ioctl issued on a directory of a locally mounted btrfs filesystem. No network protocol handler touches this path.\nAC:L - The attacker drives both sides of the race — a concurrent write/backref-walking thread that causes `btrfs_lookup_fs_root()` to return the newly inserted root, and the post-`get_new_fs_root` error (attacker-arranged ENOSPC, EDQUOT from a userspace-supplied `qgroup_inherit`, or orphan-cleanup/dentry-lookup failure) that reaches the second `free_anon_bdev()`. The ioctl can be retried in a tight loop at no cost until the window is hit.\nPR:L - Btrfs subvolume creation is deliberately unrestricted, and snapshotting only requires `inode_owner_or_capable()` on a source subvolume the attacker created themselves plus write+exec permission on a directory they own — no capability, and CAP_FOWNER/CAP_SYS_ADMIN are never consulted on this path.\nUI:N - Exploitation is entirely self-contained in the attacker's own ioctl loop plus their own background threads; no victim action, mount, or file access is needed.\nS:U - The corrupted resource is the kernel's global `unnamed_dev_ida` allocator state, managed within the same kernel security authority as the vulnerable btrfs code; no hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - The second free releases a `dev_t` still owned by an unrelated superblock (tmpfs, NFS, overlayfs, fuse, another btrfs subvolume), so `get_anon_bdev()` later hands the identical number to a second live filesystem; the resulting collapse of the `(st_dev, st_ino)` identity invariant lets nfsd fsid/filehandle resolution, overlayfs origin lookup, fanotify FIDs, and backup tooling be pointed at a different filesystem's contents, disclosing data the unprivileged attacker cannot otherwise read.\nI:H - The same device-number aliasing lets writes, restores, and filehandle-based server-side operations land on the wrong filesystem, and the double free itself corrupts the global anonymous-device ID allocator state that every anon-superblock filesystem in the kernel depends on for correct identity.\nA:H - When the number has not been reallocated, `ida_free()` hits the `WARN` at lib/idr.c:525 (\"ida_free called for id=%d which is not allocated\"), which is a kernel panic on the many hardened, cloud, and Android configurations that set `panic_on_warn`; the mangled ID-allocator state can also strand or misdirect later mounts, and the concurrently zeroed `root->anon_dev` permanently leaks device numbers from the bounded 1..2^20 minor space." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/btrfs/disk-io.c", "fs/btrfs/disk-io.h", "fs/btrfs/ioctl.c", "fs/btrfs/transaction.c" ], "versions": [ { "version": "66b317a2fc45b2ef66527ee3f8fa08fb5beab88d", "lessThan": "c34adc20b91a8e55e048b18d63f4f4ae003ecf8f", "status": "affected", "versionType": "git" }, { "version": "833775656d447c545133a744a0ed1e189ce61430", "lessThan": "eb3441093aad251418921246fc3b224fd1575701", "status": "affected", "versionType": "git" }, { "version": "5a172344bfdabb46458e03708735d7b1a918c468", "lessThan": "c8ab7521665bd0f8bc4a900244d1d5a7095cc3b9", "status": "affected", "versionType": "git" }, { "version": "e03ee2fe873eb68c1f9ba5112fee70303ebf9dfb", "lessThan": "e2b54eaf28df0c978626c9736b94f003b523b451", "status": "affected", "versionType": "git" }, { "version": "3f5d47eb163bceb1b9e613c9003bae5fefc0046f", "status": "affected", "versionType": "git" }, { "version": "e31546b0f34af21738c4ceac47d662c00ee6382f", "status": "affected", "versionType": "git" }, { "version": "5.10.210", "lessThan": "5.11", "status": "affected", "versionType": "semver" }, { "version": "5.15.149", "lessThan": "5.16", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/btrfs/disk-io.c", "fs/btrfs/disk-io.h", "fs/btrfs/ioctl.c", "fs/btrfs/transaction.c" ], "versions": [ { "version": "6.1.79", "lessThan": "6.1.81", "status": "affected", "versionType": "semver" }, { "version": "6.6.18", "lessThan": "6.6.21", "status": "affected", "versionType": "semver" }, { "version": "6.7.6", "lessThan": "6.7.9", "status": "affected", "versionType": "semver" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.79", "versionEndExcluding": "6.1.81" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.18", "versionEndExcluding": "6.6.21" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7.6", "versionEndExcluding": "6.7.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.210" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.149" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/c34adc20b91a8e55e048b18d63f4f4ae003ecf8f" }, { "url": "https://git.kernel.org/stable/c/eb3441093aad251418921246fc3b224fd1575701" }, { "url": "https://git.kernel.org/stable/c/c8ab7521665bd0f8bc4a900244d1d5a7095cc3b9" }, { "url": "https://git.kernel.org/stable/c/e2b54eaf28df0c978626c9736b94f003b523b451" } ], "title": "btrfs: fix double free of anonymous device after snapshot creation failure", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:14:13.341Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/c34adc20b91a8e55e048b18d63f4f4ae003ecf8f", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/eb3441093aad251418921246fc3b224fd1575701", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/c8ab7521665bd0f8bc4a900244d1d5a7095cc3b9", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/e2b54eaf28df0c978626c9736b94f003b523b451", "tags": [ "x_transferred" ] } ] }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-26792", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T15:50:55.740284Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:49.282Z" } } ] } }