LiveActive security incident?Get immediate response
CVE Record

CVE-2024-26726: btrfs: don't drop extent_map for free space inode on write error

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't drop extent_map for free space inode on write error While running the CI for an unrelated change I hit the following panic with generic/648 on btrfs_holes_spacecache. assertion failed: block_start != EXTENT_MAP_HOLE, in fs/btrfs/extent_io.c:1385 ------------[ cut here ]------------ kernel BUG at fs/btrfs/extent_io.c:1385! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 2695096 Comm: fsstress Kdump: loaded Tainted: G W 6.8.0-rc2+ #1 RIP: 0010:__extent_writepage_io.constprop.0+0x4c1/0x5c0 Call Trace: <TASK> extent_write_cache_pages+0x2ac/0x8f0 extent_writepages+0x87/0x110 do_writepages+0xd5/0x1f0 filemap_fdatawrite_wbc+0x63/0x90 __filemap_fdatawrite_range+0x5c/0x80 btrfs_fdatawrite_range+0x1f/0x50 btrfs_write_out_cache+0x507/0x560 btrfs_write_dirty_block_groups+0x32a/0x420 commit_cowonly_roots+0x21b/0x290 btrfs_commit_transaction+0x813/0x1360 btrfs_sync_file+0x51a/0x640 __x64_sys_fdatasync+0x52/0x90 do_syscall_64+0x9c/0x190 entry_SYSCALL_64_after_hwframe+0x6e/0x76 This happens because we fail to write out the free space cache in one instance, come back around and attempt to write it again. However on the second pass through we go to call btrfs_get_extent() on the inode to get the extent mapping. Because this is a new block group, and with the free space inode we always search the commit root to avoid deadlocking with the tree, we find nothing and return a EXTENT_MAP_HOLE for the requested range. This happens because the first time we try to write the space cache out we hit an error, and on an error we drop the extent mapping. This is normal for normal files, but the free space cache inode is special. We always expect the extent map to be correct. Thus the second time through we end up with a bogus extent map. Since we're deprecating this feature, the most straightforward way to fix this is to simply skip dropping the extent map range for this failed range. I shortened the test by using error injection to stress the area to make it easier to reproduce. With this patch in place we no longer panic with my error injection test.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2024-26726 is a Linux kernel Btrfs bug that can trigger a kernel panic after a failed write to the Btrfs free space cache. Business impact is mainly availability: affected systems using Btrfs may crash under the specific error path. The source bundle shows a kernel fix but no evidence of active exploitation.

Executive priority

Treat as a production stability issue for Btrfs-based Linux systems, not as a confirmed active attack campaign. Patch through normal kernel maintenance, escalating where a crash would interrupt critical services or where Btrfs is broadly deployed.

Technical view

The bug is in Btrfs handling of the free space cache inode. After a write error, the kernel dropped an extent map that this special inode expected to remain valid. A later retry could see an EXTENT_MAP_HOLE and hit a BUG assertion in extent writeback. The fix avoids dropping that extent map range for the failed free space cache write.

Likely exposure

Exposure is likely limited to Linux systems using Btrfs, especially configurations exercising the deprecated free space cache path. The bundle lists affected Linux kernel version ranges and stable kernel commits, but does not provide distribution-specific package names or all backport statuses.

Exploitation context

The reported crash was found during CI using fstests and later shortened with error injection. CISA KEV status is false in the bundle. No cited source states public exploitation, remote exploitation, privilege escalation, or a weaponized proof of concept.

Researcher notes

Evidence supports a kernel panic caused by Btrfs free space cache write-error handling. The bundle lacks CVSS, CWE, exploitability analysis, and distribution advisories. Avoid expanding scope beyond Btrfs and the listed Linux kernel references without additional vendor evidence.

Mitigation direction

  • Update to a kernel containing the referenced stable Btrfs fix or a vendor backport.
  • Check Linux distribution advisories for package-specific fixed versions.
  • If patching is delayed, consult vendor guidance; no workaround is named in the bundle.
  • Prioritize systems where Btrfs availability failure would affect production services.

Validation and detection

  • Inventory Linux hosts using Btrfs filesystems.
  • Verify deployed kernels include a referenced stable commit or distribution backport.
  • Review kernel logs for Btrfs BUG or panic signatures matching the source description.
  • Confirm change-management records cover availability risk for Btrfs production systems.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-26726 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
6Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux77cef2ec5484564eca6bd12a2b4a1e88fd766fbc, 77cef2ec5484564eca6bd12a2b4a1e88fd766fbc, 77cef2ec5484564eca6bd12a2b4a1e88fd766fbc, 77cef2ec5484564eca6bd12a2b4a1e88fd766fbc, 77cef2ec5484564eca6bd12a2b4a1e88fd766fbcunaffected
LinuxLinux3.12, 0, 5.15.187, 6.1.79, 6.6.18, 6.7.6, 6.8affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.