CVE-2024-42231

What it actually does

Incorrect calculation of available metadata/system chunk space in btrfs zoned mode: uses non-zone-aligned values and wrong data_chunk_size, allowing over-commit that suppresses async reclaim and triggers premature ENOSPC.

Why it matters to the business

Zoned btrfs filesystems on nearly full large-zone devices can unexpectedly fail new allocations, causing application outages or requiring manual intervention to reclaim space.

How an attack unfolds

An attacker with local access on a zoned btrfs volume fills the filesystem near capacity, then performs metadata-heavy operations that invoke the flawed calc_available_free_space logic; the resulting over-commit prevents timely reclaim and produces ENOSPC, denying service to legitimate workloads.

How to fix it

Upgrade the Linux kernel to a version containing commit 8548903b1999bba02a2b894ad750ab8eb1f40307 or later; rebuild and reboot with the patched kernel. For systems that cannot be immediately updated, monitor free space closely and trigger manual metadata reclaim when utilization approaches zone-size boundaries.

How to confirm the fix worked

Confirm the running kernel contains commit 8548903b1999bba02a2b894ad750ab8eb1f40307; after upgrade, exercise metadata allocation workloads on a near-full zoned volume and verify that ENOSPC is not incorrectly reported while sufficient zone-aligned space remains.

Typical attack path

1. Mount a btrfs filesystem configured for zoned mode on a large-zone device
2. Fill the volume to a nearly full state
3. Issue repeated metadata allocations that exercise calc_available_free_space
4. Observe suppressed async reclaim and eventual ENOSPC errors

How to detect it

Review kernel logs for btrfs ENOSPC events on zoned devices that coincide with high metadata allocation rates; correlate with df and btrfs filesystem usage output showing zone-aligned space still present.

What your security team should do

• Prioritize patching of any systems running btrfs in zoned mode, especially those with large zone sizes and high utilization
• Add the fixed commit ID to internal kernel build and deployment pipelines
• Monitor btrfs space usage metrics and ENOSPC events on zoned volumes until patches are applied