CVE-2024-50273

What it actually does

Improper list handling in btrfs delayed reference code: list_del() leaves add_list poisoned instead of reinitialized, so subsequent list_empty() and list_del() calls in drop_delayed_ref() during merge or transaction abort dereference invalid pointers, causing kernel crash when CONFIG_LIST_HARDENED or CONFIG_DEBUG_LIST are enabled.

Why it matters to the business

Kernel panic or denial of service on systems using btrfs under heavy metadata operations or transaction aborts; may interrupt services and require reboot, with higher urgency on widely deployed Linux distributions despite low EPSS.

How an attack unfolds

An attacker with local access crafts filesystem operations that insert and later merge or abort delayed refs, hitting the poisoned list state in drop_delayed_ref(); listed threat actors have targeted similar kernel resource and bounds issues in Linux.

How to fix it

Apply the upstream fix that replaces list_del() with list_del_init() in insert_delayed_ref(); update to a kernel containing the resolution for CVE-2024-50273; reboot after patching.

How to confirm the fix worked

Confirm the patched kernel source contains list_del_init() at the referenced site; run btrfs stress tests that exercise delayed ref merging and transaction aborts; verify no list poison splats occur under CONFIG_DEBUG_LIST.

Typical attack path

1. Obtain local code execution on a btrfs filesystem
2. Trigger insert_delayed_ref() that deletes a ref via list_del() and sets action to DROP
3. Force drop_delayed_ref() path via merge or transaction abort
4. Trigger list_empty() and second list_del() on poisoned add_list resulting in crash

How to detect it

Inspect kernel logs for btrfs delayed ref list poison dereference or list corruption splats around transaction abort or merge events; correlate with processes performing heavy btrfs metadata activity.

What your security team should do

• Prioritize kernel updates on all btrfs hosts within normal change windows given false KEV status but memory corruption family
• Enable CONFIG_LIST_HARDENED and monitor for related oops
• Review btrfs transaction abort logging for signs of delayed ref issues