CVE-2024-46751

What it actually does

A zero reference count condition in btrfs_lookup_extent_info triggers BUG_ON, causing kernel panic or denial of service instead of graceful error handling.

Why it matters to the business

System crashes on Linux hosts using btrfs can interrupt services and require reboots; widespread kernel usage increases exposure across servers and containers, with urgency from related recent Linux kernel privilege escalation reports.

How an attack unfolds

An attacker crafts filesystem operations or malformed metadata to reach btrfs_lookup_extent_info with a zero reference count, hitting the BUG_ON path to panic the kernel; listed threat actors exploiting similar Linux kernel issues indicate potential chaining for escalation.

How to fix it

Update the Linux kernel to the fixed commit 9c309d2434abbe880712af7e60da9ead8b6703fe or equivalent stable releases; upgrade github.com/grafana/grafana to 5.3.2 if applicable in the environment.

How to confirm the fix worked

Verify kernel source contains the updated btrfs_lookup_extent_info logic returning -EUCLEAN instead of BUG_ON; confirm transaction abort logging occurs on error paths and test with btrfs stress workloads.

Typical attack path

1. Perform targeted btrfs extent lookup operations with invalid reference counts
2. Trigger BUG_ON condition to induce kernel panic
3. Achieve denial of service or combine with other kernel flaws for further impact

How to detect it

Inspect kernel logs for btrfs_lookup_extent_info entries, transaction abort messages, and EUCLEAN errors; correlate with threat actor patterns from related Linux kernel privilege escalation attempts.

• btrfs_lookup_extent_info
• EUCLEAN
• aborting transaction
• BUG_ON

What your security team should do

• Prioritize kernel upgrades on all btrfs-using systems before any CISA-equivalent deadlines for similar issues
• Enable btrfs error logging and monitor for EUCLEAN aborts
• Review downstream dependents for exposure due to high ecosystem prevalence of the kernel