CVE-2024-26791

What it actually does

Missing validation of null-terminated device name strings passed to btrfs device replace allows out-of-bounds kernel read in getname_kernel when source or target buffers lack proper termination.

Why it matters to the business

Local users on affected Linux systems using btrfs can trigger crashes or leak kernel memory, potentially exposing sensitive data or causing denial of service on servers and endpoints that rely on device replacement operations.

How an attack unfolds

An attacker with local access crafts device names without proper string termination and supplies them to the btrfs dev-replace ioctl; the kernel then performs an unchecked read beyond the buffer in getname_kernel, disclosing memory contents or causing a crash.

How to fix it

Update the Linux kernel to a version containing commit 11d7a2e429c02d51e2dc90713823ea8b8d3d3a84 or later; apply the equivalent fix present in gitlab-org/gitlab at 2378e1fea098afa15fc0bd4aa52a102c0c1c31b4 if the component is in use.

How to confirm the fix worked

Verify the running kernel contains the referenced commit or is newer than the vulnerable release; inspect btrfs device replace code paths for the added buffer validation helper and empty-string initialization for devid sources.

Typical attack path

1. Obtain local user access on a btrfs-enabled Linux system
2. Identify or trigger a device replace operation via ioctl or command line
3. Supply source or target device name buffers lacking null termination
4. Trigger the getname_kernel call to perform the out-of-bounds read
5. Observe kernel memory disclosure or system instability

How to detect it

Review kernel audit logs and dmesg for oops or panic entries referencing getname_kernel or btrfs dev-replace; examine process command lines and ioctl traces for device replace operations with suspiciously long or unterminated device name arguments.

What your security team should do

• Prioritize kernel updates on all btrfs-using systems within standard patch windows
• Restrict untrusted local user access to btrfs device management commands until patched
• Monitor for upstream stable kernel releases that backport the fix