LiveActive security incident?Get immediate response
CVE Record

CVE-2024-26791: btrfs: dev-replace: properly validate device names

In the Linux kernel, the following vulnerability has been resolved: btrfs: dev-replace: properly validate device names There's a syzbot report that device name buffers passed to device replace are not properly checked for string termination which could lead to a read out of bounds in getname_kernel(). Add a helper that validates both source and target device name buffers. For devid as the source initialize the buffer to empty string in case something tries to read it later. This was originally analyzed and fixed in a different way by Edward Adam Davis (see links).

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2024-26791 is a Linux kernel Btrfs bug in device replacement handling. Device name buffers were not properly checked for string termination, which could cause an out-of-bounds kernel read. The sources do not provide a CVSS score or confirmed business impact, so urgency depends on affected kernel exposure and Btrfs use.

Executive priority

Treat as a targeted kernel maintenance item, not an emergency, unless critical systems use affected Btrfs storage paths. Because impact and exploitability are not scored in the bundle, prioritize confirmation and patching through normal kernel update channels.

Technical view

In Btrfs dev-replace code, source and target device name buffers lacked sufficient validation before use, creating a possible read out of bounds in getname_kernel(). The kernel fix adds validation for both buffers and initializes the source buffer to an empty string when a device ID source is used.

Likely exposure

Potentially exposed systems are Linux hosts running affected kernel versions with Btrfs enabled or reachable device replacement workflows. The bundle lists Linux versions including 3.8 through 6.8 and multiple stable point releases. Distribution kernel exposure should be confirmed from vendor advisories and package versions.

Exploitation context

The source bundle cites a syzbot report, but does not cite public exploitation, weaponized proof of concept, or CISA KEV listing. Attacker preconditions, required privileges, and practical exploitability are not established in the provided evidence.

Researcher notes

Evidence is limited to the CVE record, kernel stable commits, and Debian LTS notices. The issue is a missing string-termination validation path in Btrfs dev-replace leading to out-of-bounds read risk in getname_kernel(). No CWE, CVSS, or exploit details are provided.

Mitigation direction

  • Update affected Linux kernels to vendor builds containing the referenced stable fixes.
  • Check Debian LTS advisories if using affected Debian kernel packages.
  • Review kernel vendor guidance before applying distribution-specific backports.
  • Prioritize systems using Btrfs device replacement or storage administration workflows.

Validation and detection

  • Inventory Linux kernel versions across hosts and appliances.
  • Identify systems with Btrfs filesystems enabled or in use.
  • Map running kernels to vendor advisories or referenced stable commits.
  • Confirm patched package installation and reboot into the fixed kernel.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-26791 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
11Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe93c89c1aaaaaec3487c4c18dd02360371790722, e93c89c1aaaaaec3487c4c18dd02360371790722, e93c89c1aaaaaec3487c4c18dd02360371790722, e93c89c1aaaaaec3487c4c18dd02360371790722, e93c89c1aaaaaec3487c4c18dd02360371790722, e93c89c1aaaaaec3487c4c18dd02360371790722, e93c89c1aaaaaec3487c4c18dd02360371790722, e93c89c1aaaaaec3487c4c18dd02360371790722unaffected
LinuxLinux3.8, 0, 4.19.309, 5.4.271, 5.10.212, 5.15.151, 6.1.81, 6.6.21, 6.7.9, 6.8affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.