CVE-2024-43885

What it actually does

The flaw causes a double unlock of an inode mutex in the btrfs direct IO synchronous write path under error conditions such as skipped logging, transaction start failure, or delalloc flush errors, violating locking invariants.

Why it matters to the business

Linux systems using btrfs may experience kernel instability, crashes, or unexpected behavior during certain file write operations, potentially disrupting services and risking data integrity on affected Debian deployments.

How an attack unfolds

A local attacker triggers the vulnerable error paths in btrfs_sync_file during a direct IO sync write, causing the double unlock that can lead to use-after-free or race conditions exploitable for denial of service or further kernel compromise.

How to fix it

Upgrade the linux package on Debian 12 to version 6.1.106-1 or newer; apply the fix across all kernels shipping the affected btrfs direct IO code.

How to confirm the fix worked

Confirm the running kernel reports version 6.1.106-1 or later, then exercise direct IO sync writes on btrfs volumes while monitoring for locking-related warnings or panics.

Typical attack path

1. Obtain local unprivileged access on a btrfs-based Linux system
2. Issue a direct IO synchronous write that forces an error path under the out_release_extents label
3. Trigger the erroneous second unlock at btrfs_direct_write to induce locking violation

How to detect it

Search kernel logs and crash dumps for btrfs-related messages mentioning inode unlock, out_release_extents, or double unlock conditions during sync writes.

What your security team should do

• Apply the 6.1.106-1 kernel update on all Debian 12 systems immediately
• Audit btrfs usage and direct IO workloads for exposure
• Enable kernel crash reporting and monitor for inode locking oopses until patches are deployed