CVE-2021-47599

What it actually does

The flaw triggers a kernel warning in btrfs_show_devname when fs_devices::devices are moved to seed_list during btrfs_prepare_sprout, leaving no devices visible to the function that builds mountinfo.

Why it matters to the business

Produces noisy kernel warnings on systems using btrfs seed-device workflows, increasing alert fatigue and complicating routine monitoring without direct service disruption.

How an attack unfolds

An attacker with local access performs btrfs sprout or mount operations that invoke show_mountinfo; the resulting device-list mismatch causes the warning. No remote or privilege-escalation path is known and EPSS remains negligible.

How to fix it

Apply the upstream fix that substitutes latest_dev->name for the device-list walk; rebuild and boot the corrected kernel. No per-distribution fixed versions are listed in the source data.

How to confirm the fix worked

Boot the patched kernel, repeat the sprout or mountinfo workload, and confirm the warning no longer appears in dmesg or kernel logs.

Typical attack path

1. Obtain local shell on a btrfs host
2. Trigger btrfs_prepare_sprout or equivalent device-list manipulation
3. Read /proc/self/mounts or invoke mountinfo collection
4. Observe the warning emitted from btrfs_show_devname

How to detect it

Search kernel logs and systemd journal for the exact warning emitted by btrfs_show_devname during mountinfo collection; correlate with processes reading /proc/self/mounts.

• btrfs_show_devname+0x104/0x1e8 [btrfs]
• WARNING: CPU: .* PID: .* at fs/btrfs/super.c:2509 btrfs_show_devname

What your security team should do

• Treat as low-priority kernel hygiene update given low EPSS and absence from KEV
• Include btrfs_show_devname warning strings in kernel-log monitoring rules
• Schedule routine kernel upgrades that contain the latest_dev change