CVE-2024-39496

What it actually does

Race condition in btrfs_load_zone_info extracts a device pointer from the chunk map without holding the device replace rwsem, allowing the source device of a concurrent replace operation to be freed while still in use and triggering a use-after-free.

Why it matters to the business

Systems running btrfs on zoned storage that perform device replacements may experience kernel crashes or local privilege escalation, leading to downtime and potential full system compromise.

How an attack unfolds

An attacker with local access triggers a device replace operation while simultaneously causing block group creation that calls btrfs_load_zone_info; the missing rwsem protection allows the replace to complete and free the device before the zone info use finishes, resulting in a use-after-free that can be leveraged for memory corruption.

How to fix it

Update the Linux kernel to a version containing commit 17765964703b88d8befd899f8501150bb7e07e43 or later; rebuild and reboot with the patched kernel. Disable btrfs device replace operations until the update is applied if immediate patching is not possible.

How to confirm the fix worked

Verify the running kernel contains commit 17765964703b88d8befd899f8501150bb7e07e43 via git log or kernel version string; attempt to reproduce the race under controlled conditions and confirm absence of use-after-free reports in kernel logs.

Typical attack path

1. Obtain local user access on a btrfs zoned system
2. Initiate a device replace operation on the btrfs filesystem
3. Trigger concurrent block group creation or zone info loading
4. Exploit the resulting use-after-free for memory corruption or code execution

How to detect it

Inspect kernel logs and dmesg for btrfs-related use-after-free or slab corruption messages occurring around device replace operations; review audit logs for device replace commands and correlate with any oops or panic entries referencing zone info loading.

What your security team should do

• Prioritize kernel upgrade to include the referenced commit on all btrfs zoned deployments
• Monitor for device replace operations and temporarily restrict them on unpatched systems
• Review and apply kernel updates across the fleet within standard patch windows given the local attack vector