CVE-2024-26727

What it actually does

Removes an incorrect ASSERT in btrfs_get_root_ref that fires when a newly created subvolume is read (via backref walk) before btrfs_get_new_fs_root assigns its anon_dev, causing a kernel BUG instead of gracefully freeing the preallocated device number and continuing.

Why it matters to the business

Systems running affected Linux kernels with btrfs may experience unexpected kernel crashes during subvolume or snapshot creation, leading to denial of service and potential data unavailability until reboot; widespread in Linux distributions using btrfs.

How an attack unfolds

An attacker with local access issues btrfs subvolume creation ioctls while concurrent backref walks or other metadata operations read the in-progress subvolume tree, hitting the assertion and crashing the kernel; no remote or unauthenticated path exists.

How to fix it

Upgrade the Linux kernel to a version containing commit 3f5d47eb163bceb1b9e613c9003bae5fefc0046f or later; apply distribution-specific security updates that backport the removal of the ASSERT and the anon_dev handling logic.

How to confirm the fix worked

Confirm the running kernel contains the fix commit or is newer than the affected stable branches; attempt to reproduce the original syzbot reproducer under the patched kernel and verify no BUG occurs; inspect btrfs disk-io.c for absence of the assertion.

Typical attack path

1. Obtain local user access on a btrfs filesystem
2. Trigger concurrent subvolume creation via btrfs ioctl_snap_create or mksubvol
3. Induce backref walks or tree reads on the new root before anon_dev assignment completes
4. Trigger the ASSERT failure in btrfs_get_root_ref resulting in kernel BUG and panic

How to detect it

Review kernel logs for 'assertion failed: !anon_dev' or 'kernel BUG at fs/btrfs/disk-io.c:1319' messages around the time of subvolume creation activity; examine audit logs for btrfs ioctl calls from untrusted processes.

What your security team should do

• Prioritize kernel updates on all btrfs-using systems within standard patch windows
• Monitor for upstream btrfs changes related to subvolume creation and root reference handling
• Restrict unprivileged use of btrfs ioctls via mount options or user namespaces where feasible