CVE-2021-47433

What it actually does

Logic error in btrfs_replace_file_extents causes incorrect abort decision during error handling; preallocation code paths are not covered, allowing a missing extent in the middle of a file and resulting filesystem corruption.

Why it matters to the business

Btrfs filesystems on Linux kernels may silently corrupt file data under rare error conditions, increasing risk of data loss and requiring restoration from backups.

How an attack unfolds

An attacker triggers the faulty path by performing file preallocation or clone operations while inducing a non-EOPNOTSUPP error; the missing abort leaves the filesystem in an inconsistent state with a hole in the extent map.

How to fix it

Update to a Linux kernel containing the corrected abort logic in btrfs_replace_file_extents; rebuild and reboot with the patched kernel image.

How to confirm the fix worked

Confirm the running kernel contains the upstream commit that fixes the if-condition; run targeted error-injection tests exercising preallocation paths and verify no missing extents occur.

Typical attack path

1. Mount a btrfs filesystem
2. Issue fallocate or clone operations on a target file
3. Induce a transient error (e.g., via fault injection or resource pressure) that returns a value other than -EOPNOTSUPP
4. Continue normal writes, leaving a missing extent in the middle of the file

How to detect it

Inspect kernel logs for btrfs abort or corruption messages around the time of file preallocation or clone activity; examine btrfs extent trees for unexpected holes after error conditions.

What your security team should do

• Prioritize kernel updates on all systems using btrfs for storage
• Review backup and recovery procedures for btrfs volumes
• Monitor kernel logs for btrfs transaction abort messages
• Test patched kernels in staging environments before broad deployment