CVE-2024-46841

What it actually does

The flaw causes a BUG_ON assertion failure on ENOMEM from btrfs_lookup_extent_info() inside walk_down_proc(), resulting in a kernel panic instead of returning the error.

Why it matters to the business

Unexpected system crashes on Btrfs-based Linux systems under memory pressure, leading to downtime and potential data access disruption; low urgency given stable low EPSS and absence from KEV.

How an attack unfolds

An attacker with local access or the ability to induce memory pressure could trigger the btrfs walk_down_proc() code path, forcing the unhandled ENOMEM condition and subsequent kernel panic. No public exploits or confirmed threat actor usage reported despite generic mentions of kernel-related campaigns.

How to fix it

Apply the fix by updating the Linux kernel to the commit c1406d8329f500e4594cd9730cd313aebc3a4333 or later stable releases containing the error-handling change; reboot after patching.

How to confirm the fix worked

Verify the running kernel includes commit c1406d8329f500e4594cd9730cd313aebc3a4333 via git log or package version checks, then confirm no BUG_ON occurs under simulated ENOMEM conditions in btrfs paths.

Typical attack path

1. Gain local execution or influence on a Btrfs-mounted system
2. Induce memory exhaustion conditions
3. Trigger btrfs extent lookup operations via filesystem activity
4. Cause walk_down_proc() to receive ENOMEM and hit BUG_ON
5. Result in kernel panic and denial of service

How to detect it

Review kernel panic logs and dmesg output for btrfs walk_down_proc or btrfs_lookup_extent_info references; correlate with low-memory events in system logs.

What your security team should do

• Prioritize kernel updates for all Btrfs-using systems within standard patch windows
• Monitor memory usage on Btrfs volumes to reduce exposure to allocation failures
• Review filesystem logs for prior btrfs-related panics as part of routine audits