CVE-2024-36027

What it actually does

Logic error in btrfs_clear_buffer_dirty allows EXTENT_BUFFER_ZONED_ZEROOUT to be set on a non-DIRTY extent buffer that is already under writeback, causing the buffer contents to be cleared immediately before bio submission and producing either invalid delayed reference items or zeroed tree nodes on disk.

Why it matters to the business

On systems using Btrfs on zoned block devices, administrators may encounter unexpected filesystem errors (EUCLEAN) or metadata corruption during normal operation, potentially requiring filesystem checks or restores; the issue is limited to specific transactional cleanup paths and has low probability of affecting on-disk data.

How an attack unfolds

An attacker with local access triggers btrfs transaction operations that allocate, mark dirty, then clean an extent buffer while it is simultaneously under IO on a zoned device; the race allows the ZEROOUT flag to be applied to the in-flight buffer, resulting in either corrupted delayed references or a cleared tree node written to media.

How to fix it

Upgrade the Linux kernel to version 6.8.8 or later, or apply the fix from commit f4b994fccbb6f294c4b31a6ca0114b09f7245043 in the stable tree. Reboot after the update and verify the running kernel version contains the corrected btrfs zoned handling.

How to confirm the fix worked

Confirm the installed kernel contains commit f4b994fccbb6f294c4b31a6ca0114b09f7245043 or is at least 6.8.8; run btrfs filesystem check on zoned volumes after upgrade and monitor for absence of EUCLEAN errors during normal transactional workloads.

Typical attack path

1. Obtain local shell or user context on a Linux system using Btrfs on zoned storage
2. Perform filesystem operations that cause repeated allocation, dirtying, and early cleanup of extent buffers within a single transaction
3. Force concurrent writeback of the same buffer to trigger the non-DIRTY + WRITEBACK state
4. Observe resulting EUCLEAN errors or trigger subsequent transaction commits that expose the zeroed node

How to detect it

Search kernel logs for EUCLEAN errors originating from btrfs delayed reference updates or tree node writes on zoned devices; inspect dmesg and journalctl output around periods of high Btrfs transaction activity for messages mentioning EXTENT_BUFFER_ZONED_ZEROOUT or cleared buffers.

What your security team should do

• Prioritize patching any systems using Btrfs on zoned devices within the next maintenance window
• Add kernel version checks to asset inventory for all Linux hosts
• Include btrfs zoned error patterns in existing filesystem monitoring rules
• Test the updated kernel on a representative zoned Btrfs deployment before broad rollout