CVE-2024-41086

What it actually does

Missing bounds check in bch2_sb_downgrade_validate and for_each_downgrade_entry allows a downgrade entry in a bcachefs superblock section to extend past the section end, enabling out-of-bounds memory access when parsing malformed on-disk metadata.

Why it matters to the business

Systems using bcachefs may experience kernel instability or crashes when mounting untrusted or corrupted filesystems, leading to downtime and potential data access issues until kernels are updated.

How an attack unfolds

An attacker supplies a crafted bcachefs filesystem image containing an oversized downgrade entry in the superblock; when the kernel parses the section during mount or validation, the unchecked iteration reads past the section boundary, potentially causing a crash or limited information disclosure.

How to fix it

Update the Linux kernel to a version containing commit bf920ed92ef24dcd6970c88881cd4700b3acf05b or later; rebuild and reboot with the patched kernel before mounting any untrusted bcachefs volumes.

How to confirm the fix worked

Confirm the running kernel contains commit bf920ed92ef24dcd6970c88881cd4700b3acf05b; attempt to mount a test image containing an overlong downgrade entry and verify the operation completes without oops or warnings.

Typical attack path

1. Craft a bcachefs filesystem superblock with a downgrade entry whose size exceeds the declared section length
2. Place the malicious image on media accessible to the target system
3. Trigger mount or superblock validation on the affected kernel
4. Observe kernel oops or undefined behavior from the out-of-bounds access

How to detect it

Review kernel logs for oops or warnings referencing bch2_sb_downgrade_validate or for_each_downgrade_entry during bcachefs mount attempts; examine audit or filesystem mount logs for unexpected bcachefs activity.

What your security team should do

• Prioritize kernel updates on all systems that enable bcachefs
• Restrict mounting of bcachefs filesystems from untrusted sources until patched
• Monitor for future bcachefs-related CVEs given ongoing development activity