CVE-2024-56759

What it actually does

Use-after-free in btrfs_cow_block when trace_btrfs_cow_block is enabled under CONFIG_PREEMPT, because the last reference on the extent buffer is dropped via free_extent_buffer_stale before the tracepoint executes.

Why it matters to the business

Kernel crashes or memory corruption on Linux systems using the btrfs filesystem, raising operational risk for servers and workstations that rely on btrfs for storage.

How an attack unfolds

An attacker triggers btrfs operations such as btrfs_search_slot that hold the final reference on a tree block; with tracing enabled the task may be preempted after the buffer is scheduled for RCU release, allowing the tracepoint to dereference already-freed memory.

How to fix it

Apply the upstream fix that relocates trace_btrfs_cow_block into btrfs_force_cow_block before the stale buffer is freed; upgrade to a kernel containing the resolution for CVE-2024-56759.

How to confirm the fix worked

Confirm the kernel source contains the relocated tracepoint call inside btrfs_force_cow_block and that the vulnerable call site in btrfs_cow_block has been removed; test with tracing enabled under CONFIG_PREEMPT.

Typical attack path

1. Enable kernel tracing on btrfs events
2. Perform filesystem operations that force COW of tree blocks
3. Trigger preemption between reference drop and tracepoint invocation
4. Access freed extent buffer memory

How to detect it

Search kernel logs for btrfs tracepoint-related use-after-free crashes or RCU stalls involving extent buffers; review audit logs for unexpected enabling of btrfs trace events.

What your security team should do

• Prioritize kernel updates on all btrfs-based systems
• Disable unnecessary tracepoints in production until patched
• Monitor for btrfs-related kernel oops or panic reports