CVE-2024-46752

What it actually does

The vulnerability is a missing error path in btrfs update_ref_for_cow that triggers a BUG_ON when an extent buffer belonging to the relocation tree lacks the full backref flag, causing an immediate kernel panic instead of graceful transaction abort.

Why it matters to the business

Unexpected kernel crashes on systems using btrfs can interrupt services, cause data unavailability, and require manual intervention or reboots, especially on storage-heavy workloads.

How an attack unfolds

An attacker with local access crafts filesystem operations that reach the relocation tree code path with a malformed extent buffer; the kernel hits the BUG_ON and panics, resulting in denial of service. No remote code execution or privilege escalation path is known from the described flaw.

How to fix it

Update the Linux kernel to a version containing commit b50857b96429a09fd3beed9f7f21b7bb7c433688 or later; for LXD-based deployments apply version 5.20 or newer. Reboot after installing the fixed kernel and verify the btrfs module loads without the vulnerable code path.

How to confirm the fix worked

Confirm the running kernel contains the fix by checking git commit b50857b96429a09fd3beed9f7f21b7bb7c433688 is present or by running a kernel that reports the updated error-handling path in update_ref_for_cow; test by exercising btrfs relocation under memory-pressure conditions and verifying no BUG_ON occurs.

Typical attack path

1. Obtain local access to a system running a vulnerable btrfs kernel
2. Trigger btrfs relocation or snapshot operations that exercise update_ref_for_cow
3. Supply or corrupt metadata so that a relocation-tree extent buffer lacks the full backref flag
4. Kernel executes BUG_ON and panics

How to detect it

Search kernel logs for BUG_ON or panic messages originating from btrfs update_ref_for_cow; inspect dmesg and syslog for relocation-tree extent-buffer warnings immediately preceding a crash; no network or file-based IOCs are available.

What your security team should do

• Prioritize kernel updates on all btrfs-using systems within the next maintenance window
• Enable btrfs error logging and monitor for transaction abort messages related to relocation trees
• Review backup and high-availability posture for workloads that rely on btrfs volumes
• Apply the fix to development, staging, and production fleets in that order