CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace
In the Linux kernel, the following vulnerability has been resolved:
btrfs: zoned: fix use-after-free due to race with dev replace
While loading a zone's info during creation of a block group, we can race
with a device replace operation and then trigger a use-after-free on the
device that was just replaced (source device of the replace operation).
This happens because at btrfs_load_zone_info() we extract a device from
the chunk map into a local variable and then use the device while not
under the protection of the device replace rwsem. So if there's a device
replace operation happening when we extract the device and that device
is the source of the replace operation, we will trigger a use-after-free
if before we finish using the device the replace operation finishes and
frees the device.
Fix this by enlarging the critical section under the protection of the
device replace rwsem so that all uses of the device are done inside the
critical section.
Security readout for executives and security teams
Plain-English summary
A race in Linux Btrfs zoned-storage handling can access a device object after it has been freed when block-group creation overlaps device replacement. This may destabilize affected systems. The supplied evidence does not establish specific confidentiality, integrity, or availability outcomes beyond the use-after-free condition.
Executive priority
Prioritize prompt assessment and patching for storage systems using Btrfs zoned mode, especially where device replacement occurs. General Linux fleets without that configuration are less likely exposed. Treat this as high priority for matching systems, but not as evidence of active exploitation.
Technical view
CVE-2024-39496 occurs when btrfs_load_zone_info() retains a device from a chunk map without holding the device-replace rwsem for every use. A concurrent replacement can finish and free the source device, producing a use-after-free. The kernel fix expands the rwsem-protected critical section.
Likely exposure
Exposure appears limited to Linux systems using Btrfs zoned storage where block-group creation can overlap a device-replacement operation. The supplied version data identifies affected Linux releases from 5.11 and lists 6.1.95, 6.6.35, 6.9.6, and 6.10, but does not reliably map distribution backports.
Exploitation context
The CVSS 3.1 score is 7.8 with local access and low privileges required. The CVE is not listed as KEV in the supplied bundle, and no cited source reports active exploitation. Practical exploitation requirements and demonstrated security impact are not established here.
Researcher notes
The vulnerability is a concurrency-driven lifetime error in Btrfs zoned code. Fix verification should focus on whether device use remains protected by the device-replace rwsem. The supplied affected-version representation is ambiguous and contains repeated commit identifiers, so distribution-specific conclusions require vendor package or backport confirmation.
Mitigation direction
Update to a vendor-supported kernel containing the applicable upstream stable fix.
Check distribution advisories because kernel fixes may be backported without matching upstream version numbers.
Prioritize systems using Btrfs zoned mode and device replacement operations.
If immediate updating is unavailable, consult vendor guidance for supported risk-reduction measures.
Validation and detection
Inventory kernel package versions and distribution security update status.
Identify hosts using Btrfs filesystems on zoned storage devices.
Determine whether affected systems perform or permit Btrfs device replacement.
Confirm the installed kernel includes the applicable referenced stable commit or vendor backport.
Review kernel logs for Btrfs faults or crashes during device replacement; absence does not prove safety.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2024-39496 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.