CVE-2024-35798

What it actually does

Race condition in btrfs read_extent_buffer_pages() allows concurrent threads to miss EXTENT_BUFFER_UPTODATE checks after setting EXTENT_BUFFER_READING, permitting use of partially read or concurrently modified extent buffers and resulting in tree-checker detected node corruption.

Why it matters to the business

Btrfs-based systems may experience unexpected metadata corruption errors, filesystem instability, or forced recovery operations, increasing operational overhead and risk of data access disruptions in storage-heavy environments.

How an attack unfolds

An attacker with local access crafts I/O patterns or filesystem operations that interleave multiple reads of the same extent buffer; the flawed check sequence lets one thread proceed with a stale buffer while another performs an in-progress read, exposing corrupted metadata to the tree checker.

How to fix it

Upgrade the Linux kernel to a version containing commit 0427c8ef8bbb7f304de42ef51d69c960e165e052 or later; rebuild and reboot with the fixed kernel; for older stable trees apply the equivalent backport if available.

How to confirm the fix worked

Verify the running kernel contains commit 0427c8ef8bbb7f304de42ef51d69c960e165e052 via git log or package version; monitor dmesg for absence of BTRFS critical corrupted node messages under concurrent btrfs metadata load.

Typical attack path

1. Obtain local code execution or shell access on a system using btrfs
2. Mount or access a btrfs volume containing metadata extent buffers
3. Trigger concurrent read operations on the same extent buffer via application or kernel workload
4. Observe tree-checker reporting corrupted nodes due to the race window

How to detect it

Search system logs (dmesg, /var/log/kern.log, journalctl) for BTRFS critical messages mentioning corrupted node, owner mismatch, or expect values; correlate with periods of high btrfs metadata activity.

• BTRFS critical (device
• corrupted node, root=
• owner mismatch, have
• expect [256, 18446744073709551360]

What your security team should do

• Prioritize kernel updates on all systems using btrfs filesystems
• Review kernel logs for BTRFS critical corrupted node entries as an immediate detection step
• Test the fixed kernel in staging environments before broad deployment
• Consider temporary mitigation by reducing concurrent metadata access workloads if patching is delayed