CVE-2024-46840

What it actually does

Improper handling of zero reference counts during btrfs snapshot deletion can trigger BUG_ON assertions or return inappropriate error codes when extent tree data is transiently inconsistent or corrupted, potentially causing kernel instability.

Why it matters to the business

Systems using btrfs may experience unexpected crashes or degraded reliability during snapshot operations, increasing downtime risk especially on high-usage storage setups; no widespread exploitation observed but fixed versions available since late 2024.

How an attack unfolds

An attacker with local access or ability to induce filesystem corruption could trigger snapshot deletion paths that hit unhandled refs==0 conditions, leading to kernel panics; no named threat actors have been linked to active exploitation of this specific issue.

How to fix it

Update the Linux kernel to a version containing commit c847b28a799733b04574060ab9d00f215970627d or later; rebuild and deploy affected distributions with the corrected btrfs snapshot deletion error handling.

How to confirm the fix worked

Confirm kernel version includes the referenced commit; test snapshot creation/deletion workloads under simulated corruption to verify absence of BUG_ON and correct -EUCLEAN returns instead of -EIO.

Typical attack path

1. Obtain local access or ability to corrupt btrfs extent tree metadata
2. Initiate snapshot deletion operations that reach walk_down_proc, do_walk_down, or walk_up_proc
3. Force refs==0 condition via race or corruption to hit original BUG_ON or mishandled error path
4. Trigger kernel panic or denial of service

How to detect it

Search kernel logs for btrfs-related BUG or EUCLEAN messages during snapshot deletion; examine dmesg or syslog for extent tree errors around the time of filesystem operations.

What your security team should do

• Prioritize kernel updates on all btrfs-using systems within standard patch cycles
• Monitor for btrfs-related kernel oops or panics in system logs
• Review backup and snapshot policies to reduce reliance on frequent deletions during high-risk periods