CVE-2021-3739

What it actually does

NULL pointer dereference in btrfs_rm_device allows a local process with CAP_SYS_ADMIN to trigger a kernel crash or leak internal memory contents.

Why it matters to the business

Unexpected system restarts cause service outages and may expose sensitive kernel data to attackers on the same host.

How an attack unfolds

An attacker with local access and administrative capabilities invokes btrfs device removal operations that reach the flawed code path, dereferencing a null pointer and either crashing the kernel or reading kernel memory.

How to fix it

Upgrade the Linux kernel to the commit e4571b8c5e9ffa1e85c0c671995bd4dcc5c75091 or later; apply the vendor-supplied kernel update that resolves the null dereference in btrfs_rm_device.

How to confirm the fix worked

Verify the running kernel contains commit e4571b8c5e9ffa1e85c0c671995bd4dcc5c75091; attempt to reproduce the btrfs device removal operation under a non-privileged account and confirm no crash or leak occurs.

Typical attack path

1. Obtain local shell with CAP_SYS_ADMIN privileges
2. Prepare or mount a btrfs volume
3. Invoke btrfs device removal ioctl or command that reaches btrfs_rm_device
4. Trigger the null dereference to crash the system or read kernel memory

How to detect it

Review kernel logs for oops or panic messages referencing btrfs_rm_device or volumes.c; correlate with process execution that performs btrfs device removal operations.

• btrfs_rm_device
• fs/btrfs/volumes.c
• kernel: btrfs: .*NULL pointer dereference

What your security team should do

• Apply the kernel fix immediately on all systems using btrfs
• Restrict CAP_SYS_ADMIN to only trusted administrative accounts
• Monitor for kernel oops or panic events involving btrfs volumes