CVE-2024-41067

What it actually does

The flaw causes an assertion failure in scrub_read_endio when btrfs_map_block fails to locate an RST entry for a scrub target after a newly allocated empty bbio is immediately ended, resulting in invalid sector_nr calculation against stripe->nr_sectors.

Why it matters to the business

Systems using btrfs with the raid stripe tree feature enabled may experience unexpected kernel crashes during scrub operations, leading to downtime and potential data access disruption until patched kernels are deployed.

How an attack unfolds

An attacker with local access triggers btrfs scrub on a filesystem with forced RST, causing btrfs_map_block to fail lookup; the resulting empty bbio submission leads to the endio path hitting the assertion and crashing the kernel.

How to fix it

Update the Linux kernel to a version containing commit 17d1fd302a53d7e456a7412da74be74a0cf63a72 which reorders btrfs_map_block before bbio allocation to avoid handling empty bios and eliminates the race on pending_io.

How to confirm the fix worked

Confirm the running kernel includes commit 17d1fd302a53d7e456a7412da74be74a0cf63a72; re-run btrfs scrub with forced RST and verify absence of the assertion crash and tree dumps from btrfs_get_raid_extent_offset.

Typical attack path

1. Obtain local access on a btrfs filesystem with RST enabled
2. Initiate or force a scrub operation targeting a range without a valid RST entry
3. Trigger btrfs_map_block failure on newly allocated bbio
4. Cause scrub_read_endio to process empty bvecs and hit ASSERT(sector_nr < stripe->nr_sectors)

How to detect it

Inspect kernel logs for assertion failures in scrub_read_endio, tree dumps mentioning btrfs_get_raid_extent_offset failures, and any btrfs scrub processes that terminate abnormally.

What your security team should do

• Prioritize kernel upgrades to the fixed commit on all btrfs systems using RST
• Monitor for kernel oops or panic logs referencing scrub_read_endio and btrfs_get_raid_extent_offset
• Temporarily disable RST or scrub operations if immediate patching is not feasible