CVE-2023-53618

What it actually does

The vulnerability permits invalid reloc tree root keys (such as for quota trees) in btrfs metadata to reach prepare_to_merge(), triggering an ASSERT that the reloc tree is not properly referenced by its subvolume tree and causing a kernel crash.

Why it matters to the business

Unexpected system crashes and loss of availability on Linux hosts using the btrfs filesystem when processing corrupted on-disk metadata; urgency is low given no KEV listing or ransomware use but high ecosystem prevalence of the kernel.

How an attack unfolds

An attacker supplies a maliciously crafted btrfs filesystem image containing an invalid reloc tree root key for a non-subvolume tree; when the kernel mounts or balances the filesystem the tree-checker fails to reject it, the ASSERT fires, and the system panics. Related kernel privilege-escalation campaigns have targeted similar btrfs and container-optimized OS paths.

How to fix it

Apply the upstream btrfs tree-checker rejection of invalid reloc tree root keys. For the listed affected package upgrade activerecord (RubyGems) to version 3.2.19.

How to confirm the fix worked

Confirm the kernel contains the patch that adds explicit root-key validation in the tree-checker for TREE_RELOC_OBJECTID; test by attempting to mount an image containing an invalid reloc root key and verifying graceful rejection instead of ASSERT.

Typical attack path

1. Obtain local access or ability to present a filesystem image to a target Linux system
2. Craft or corrupt a btrfs volume so that a reloc tree root key references a non-subvolume tree (e.g., quota tree)
3. Cause the victim kernel to mount, scrub, or balance the volume
4. Trigger the ASSERT inside prepare_to_merge() resulting in denial of service

How to detect it

Search kernel logs for the exact BTRFS error string mentioning reloc tree mismatch and unexpected root keys; inspect mounted btrfs volumes for anomalous TREE_RELOC_OBJECTID entries pointing at non-subvolume trees.

• BTRFS error (device .*): reloc tree mismatch, root .* has no reloc root, expect reloc root key
• TREE_RELOC_OBJECTID.*QUOTA_TREE_OBJECTID

What your security team should do

• Prioritize patching Linux kernel btrfs modules on all systems that use the filesystem
• Upgrade activerecord (RubyGems) to 3.2.19 where the package appears in any dependency tree
• Enable btrfs integrity checks and monitor for BTRFS error messages referencing reloc tree mismatch
• Restrict untrusted filesystem images from being mounted on production hosts