CVE-2024-49882

What it actually does

Double brelse() on an ext4 extent path buffer head in ext4_ext_try_to_merge_up() when error paths during extent splitting (such as -ENOMEM in ext4_find_extent after depth increase) leave a stale p_bh pointer that is later freed again in ext4_free_ext_path().

Why it matters to the business

Kernel instability or crashes possible on ext4 filesystems during file writes or extent operations; low immediate risk given stable low EPSS, no KEV listing, and no confirmed exploitation despite 721 days since publication.

How an attack unfolds

An attacker with local access crafts sequences of extent splits and merge-up operations (for example via fallocate or writes triggering ext4_split_convert_extents) that hit the error path leaving path[1].p_bh non-NULL, then triggers a second free; listed threat actors reference generic Linux kernel issues but no specific campaigns target this double-release flaw.

How to fix it

Upgrade the Linux kernel to commit d4574bda63906bf69660e001470bfe1a0ac524ae or later; for Rocky Linux 8 update nodejs-nodemon to 1.18.3-1.module+el8.3.0+101+f84c7154 and nodejs-packaging to 17-3.module+el8.3.0+101+f84c7154; set path[1].p_bh = NULL immediately after brelse in ext4_ext_try_to_merge_up().

How to confirm the fix worked

Verify the fix commit is present in the running kernel; reproduce the original split1/split2 sequence and confirm absence of the 'Trying to free free buffer' warning; check dmesg or kernel logs for the __brelse warning at fs/buffer.c:1241.

Typical attack path

1. Local process performs writes or allocations that invoke ext4_ext_map_blocks and trigger split1
2. ext4_split_extent_at hits -ENOMEM in ext4_ext_grow_indepth then ext4_find_extent
3. ext4_ext_try_to_merge_up performs brelse(path[1].p_bh) without nulling the pointer
4. Later split2 path reuses the stale pointer and calls brelse again via ext4_free_ext_path
5. Kernel emits VFS buffer warning and may panic or corrupt state

How to detect it

Search kernel logs and dmesg for the exact warning 'VFS: brelse: Trying to free free buffer' or the stack trace containing __brelse+0x58 and ext4_ext_insert_extent; correlate with processes performing ext4 extent splits; no ransomware or CISA KEV indicators apply.

• VFS: brelse: Trying to free free buffer
• WARNING: CPU:.* at fs/buffer.c:1241 __brelse+0x58/0x90
• ext4_ext_try_to_merge_up
• ext4_free_ext_path

What your security team should do

• Prioritize kernel updates on all ext4 systems within standard patch windows given low EPSS and no KEV
• Add kernel log monitoring for brelse double-free warnings
• Review ext4 extent-related workloads for stability after patching
• Track EPSS trend (stable at ~0.0032) for any future increase