CVE-2024-42314

What it actually does

Use-after-free in btrfs extent map handling during compressed bio page addition at add_ra_bio_pages where add_size is computed after reference drop.

Why it matters to the business

Local attackers with low privileges can trigger kernel crashes or escalate to full system compromise on Linux systems using the btrfs filesystem; 348 downstream dependents increase exposure surface across distributions and embedded devices.

How an attack unfolds

An attacker with local access crafts I/O operations on a btrfs filesystem that trigger compressed bio paths, causing the kernel to access a freed extent map object and resulting in memory corruption that can be leveraged for code execution or denial of service; listed threat actors have shown interest in similar Linux kernel memory safety issues.

How to fix it

Update the Linux kernel to a version containing the fix for the btrfs extent map reference handling in compressed bio paths; apply the patch that computes add_size before dropping the extent map reference.

How to confirm the fix worked

Confirm kernel version is newer than the vulnerable release and that the btrfs compressed bio path change is present in source; run regression tests exercising compressed read-ahead on btrfs volumes.

Typical attack path

1. Obtain local user access on target Linux system
2. Mount or access a btrfs volume with compression enabled
3. Trigger read-ahead bio operations that exercise add_ra_bio_pages
4. Trigger use-after-free via freed extent map access
5. Leverage resulting memory corruption for privilege escalation or crash

How to detect it

Review kernel logs for oops or panic messages involving btrfs extent maps and compressed bios; inspect for unusual local process activity triggering read-ahead on btrfs volumes.

What your security team should do

• Prioritize kernel updates on all systems using btrfs
• Monitor for local privilege escalation attempts on multi-user systems
• Restrict untrusted local access until patches are applied
• Review downstream dependent packages for bundled kernel components