CVE-2024-41078

What it actually does

The vulnerability causes a reference leak on the quota root object in the Btrfs filesystem when quota disable operations fail during tree cleaning or root deletion, leaving the root unreleased after fs_info->quota_root is set to NULL.

Why it matters to the business

Systems running affected Linux kernels may experience gradual kernel memory exhaustion when Btrfs quotas are disabled under failure conditions, potentially leading to resource pressure or instability in long-running servers with high filesystem usage.

How an attack unfolds

An attacker with the ability to trigger Btrfs quota disable operations on affected kernels can cause repeated failures in quota tree cleanup paths, resulting in accumulated unreleased root references and memory consumption.

How to fix it

Update the Linux kernel to a version containing commit 94818bdb00ef34a996a06aa63d11f591074cb757 or later in the stable tree; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Verify the running kernel contains the fix commit, then test quota enable/disable cycles under simulated failure conditions to confirm no quota_root leaks occur.

Typical attack path

1. Gain local access or control sufficient to mount and manage Btrfs filesystems
2. Enable quotas on a Btrfs volume
3. Trigger quota disable while inducing failures in quota tree cleaning or root deletion
4. Repeat operations to accumulate leaked quota root references

How to detect it

Inspect kernel logs for Btrfs qgroup and quota disable error paths, correlate with memory usage trends in slab or page allocator statistics for quota root objects.

What your security team should do

• Prioritize kernel updates on all systems using Btrfs with quotas enabled
• Review Btrfs quota usage and consider temporary disablement on unpatched systems if operationally feasible
• Monitor kernel memory statistics for unexpected growth in Btrfs-related structures