LiveActive security incident?Get immediate response
CVE Record

CVE-2024-39496: btrfs: zoned: fix use-after-free due to race with dev replace

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix use-after-free due to race with dev replace While loading a zone's info during creation of a block group, we can race with a device replace operation and then trigger a use-after-free on the device that was just replaced (source device of the replace operation). This happens because at btrfs_load_zone_info() we extract a device from the chunk map into a local variable and then use the device while not under the protection of the device replace rwsem. So if there's a device replace operation happening when we extract the device and that device is the source of the replace operation, we will trigger a use-after-free if before we finish using the device the replace operation finishes and frees the device. Fix this by enlarging the critical section under the protection of the device replace rwsem so that all uses of the device are done inside the critical section.

HighCVSS 7.8Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A race in Linux Btrfs zoned-storage handling can access a device object after it has been freed when block-group creation overlaps device replacement. This may destabilize affected systems. The supplied evidence does not establish specific confidentiality, integrity, or availability outcomes beyond the use-after-free condition.

Executive priority

Prioritize prompt assessment and patching for storage systems using Btrfs zoned mode, especially where device replacement occurs. General Linux fleets without that configuration are less likely exposed. Treat this as high priority for matching systems, but not as evidence of active exploitation.

Technical view

CVE-2024-39496 occurs when btrfs_load_zone_info() retains a device from a chunk map without holding the device-replace rwsem for every use. A concurrent replacement can finish and free the source device, producing a use-after-free. The kernel fix expands the rwsem-protected critical section.

Likely exposure

Exposure appears limited to Linux systems using Btrfs zoned storage where block-group creation can overlap a device-replacement operation. The supplied version data identifies affected Linux releases from 5.11 and lists 6.1.95, 6.6.35, 6.9.6, and 6.10, but does not reliably map distribution backports.

Exploitation context

The CVSS 3.1 score is 7.8 with local access and low privileges required. The CVE is not listed as KEV in the supplied bundle, and no cited source reports active exploitation. Practical exploitation requirements and demonstrated security impact are not established here.

Researcher notes

The vulnerability is a concurrency-driven lifetime error in Btrfs zoned code. Fix verification should focus on whether device use remains protected by the device-replace rwsem. The supplied affected-version representation is ambiguous and contains repeated commit identifiers, so distribution-specific conclusions require vendor package or backport confirmation.

Mitigation direction

  • Update to a vendor-supported kernel containing the applicable upstream stable fix.
  • Check distribution advisories because kernel fixes may be backported without matching upstream version numbers.
  • Prioritize systems using Btrfs zoned mode and device replacement operations.
  • If immediate updating is unavailable, consult vendor guidance for supported risk-reduction measures.

Validation and detection

  • Inventory kernel package versions and distribution security update status.
  • Identify hosts using Btrfs filesystems on zoned storage devices.
  • Determine whether affected systems perform or permit Btrfs device replacement.
  • Confirm the installed kernel includes the applicable referenced stable commit or vendor backport.
  • Review kernel logs for Btrfs faults or crashes during device replacement; absence does not prove safety.
Prepared
Confidence
high
Sources
7

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-39496 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
2ADP providers
6Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2024-39496Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux5b316468983dfa9473ff0f1c42e4e30b4c267141, 5b316468983dfa9473ff0f1c42e4e30b4c267141, 5b316468983dfa9473ff0f1c42e4e30b4c267141, 5b316468983dfa9473ff0f1c42e4e30b4c267141unaffected
LinuxLinux5.11, 0, 6.1.95, 6.6.35, 6.9.6, 6.10affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.