LiveActive security incident?Get immediate response
CVE Record

CVE-2024-35936: btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks()

In the Linux kernel, the following vulnerability has been resolved: btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() The unhandled case in btrfs_relocate_sys_chunks() loop is a corruption, as it could be caused only by two impossible conditions: - at first the search key is set up to look for a chunk tree item, with offset -1, this is an inexact search and the key->offset will contain the correct offset upon a successful search, a valid chunk tree item cannot have an offset -1 - after first successful search, the found_key corresponds to a chunk item, the offset is decremented by 1 before the next loop, it's impossible to find a chunk item there due to alignment and size constraints

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2024-35936 is a Linux kernel Btrfs filesystem flaw involving an unhandled error case during system chunk relocation. The public record describes it as a corruption condition. Business urgency depends on whether affected Linux systems use Btrfs; no public source here confirms active exploitation or a severity score.

Executive priority

Treat this as a targeted kernel hygiene issue, not an emergency without more evidence. Prioritize assets using Btrfs, especially where filesystem corruption would affect availability, recovery, or regulated data retention. Patch through normal kernel update channels once vendor packages are available.

Technical view

The issue is in btrfs_relocate_sys_chunks(), where a chunk tree lookup error was not handled in a loop. The kernel fix treats the unexpected lookup condition as corruption rather than continuing through impossible chunk-item states. Affected Linux kernel versions are listed in the CVE record, with stable kernel commits referenced as fixes.

Likely exposure

Exposure is most likely on Linux hosts, appliances, or embedded products running affected kernel versions and using Btrfs. Systems not using Btrfs appear less exposed based on the described vulnerable component. Downstream exposure should be checked through OS and vendor advisories, including Debian LTS and Siemens references.

Exploitation context

The supplied sources do not report active exploitation, and the CVE is not marked KEV. No CVSS score or CWE is provided. The impact is described as filesystem corruption handling inside Btrfs, so assess operational risk where Btrfs protects important data or availability-sensitive workloads.

Researcher notes

Evidence is limited to the CVE description, affected-version metadata, and stable kernel references. The record explains the logic flaw but does not provide CVSS, exploit prerequisites, or concrete impact beyond corruption handling. Validate using kernel branch fixes and downstream advisories rather than extrapolating exploitability.

Mitigation direction

  • Apply kernel updates that include the referenced stable Btrfs fixes.
  • Prioritize systems using Btrfs for patch validation and maintenance windows.
  • Check distribution advisories for packaged kernel fix availability.
  • Review vendor advisories for appliances or products embedding Linux kernels.
  • Avoid inventing workarounds; follow kernel, distribution, or product vendor guidance.

Validation and detection

  • Inventory Linux kernel versions across servers, endpoints, and appliances.
  • Identify systems using Btrfs for root, data, or backup filesystems.
  • Compare installed kernels against CVE and vendor affected-version guidance.
  • Confirm patched kernels include the referenced stable commits or downstream fixes.
  • Track Debian LTS, Siemens, and other vendor advisories for environment-specific status.
Prepared
Confidence
medium
Sources
12

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-35936 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
3ADP providers
12Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container
siemens-SADPADP container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux2b82032c34ec40515d3c45c36cd1961f37977de8, 2b82032c34ec40515d3c45c36cd1961f37977de8, 2b82032c34ec40515d3c45c36cd1961f37977de8, 2b82032c34ec40515d3c45c36cd1961f37977de8, 2b82032c34ec40515d3c45c36cd1961f37977de8, 2b82032c34ec40515d3c45c36cd1961f37977de8, 2b82032c34ec40515d3c45c36cd1961f37977de8, 2b82032c34ec40515d3c45c36cd1961f37977de8unaffected
LinuxLinux2.6.29, 0, 4.19.312, 5.4.274, 5.10.215, 5.15.155, 6.1.86, 6.6.27, 6.8.6, 6.9affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.