CVE-2024-35936

What it actually does

Unhandled error return from chunk tree lookup in btrfs_relocate_sys_chunks() allows an invalid search key (offset -1) or misaligned subsequent key to go unprocessed, resulting in kernel crash or denial of service.

Why it matters to the business

Linux systems using the btrfs file system may experience unexpected crashes or service interruptions when the vulnerable code path is reached, increasing operational downtime risk for affected kernels; no widespread exploitation observed.

How an attack unfolds

An attacker with local access crafts or triggers conditions that cause btrfs_relocate_sys_chunks() to perform a chunk tree search returning an error case; the missing error handling allows the loop to continue with corrupted or invalid key state, leading to a crash.

How to fix it

Update the Linux kernel to a version containing commit bebd9e0ff90034875c5dfe4bd514fd7055fc7a89 or later; rebuild and reboot with the patched kernel; apply vendor-supplied updates for all affected distributions.

How to confirm the fix worked

Confirm the running kernel contains commit bebd9e0ff90034875c5dfe4bd514fd7055fc7a89; verify btrfs_relocate_sys_chunks() properly handles lookup errors; run regression tests exercising system chunk relocation.

Typical attack path

1. Obtain local user access on a Linux system running a vulnerable kernel with btrfs enabled
2. Trigger btrfs system chunk relocation via file system operations or crafted metadata
3. Force the chunk tree lookup to hit the unhandled error condition inside the relocation loop
4. Kernel panics due to unprocessed corruption-like state

How to detect it

Review kernel logs for btrfs relocation errors or unexpected crashes during chunk tree operations; examine audit and system logs for local processes triggering btrfs metadata changes around crash timestamps.

What your security team should do

• Prioritize patching all production systems running vulnerable kernels within standard change windows
• Monitor upstream stable kernel releases for backports of the fix
• Restrict untrusted local access on systems using btrfs until patched
• Test the updated kernel in staging environments before broad deployment