Security readout for executives and security teams
Plain-English summary
A race condition in Linux Btrfs block-group cleanup can corrupt an internal kernel list and trigger a kernel crash. It is most relevant when Btrfs relocation runs into insufficient chunk space. The 7.8 CVSS score models severe confidentiality, integrity, and availability impact, although the supplied evidence specifically demonstrates list corruption and a kernel BUG.
Executive priority
Treat as a high-priority kernel update for Btrfs-dependent servers, shared hosts, and systems where local users are not fully trusted. It is not presented as an internet-routable or actively exploited emergency. Patch promptly through normal change controls, accelerating systems with frequent storage pressure or high availability requirements.
Technical view
During Btrfs block-group reclaim, concurrent addition to the reclaim and unused lists can corrupt the list head. The observed path involves btrfs_reclaim_bgs_work and can occur when relocation ends with ENOSPC. The upstream correction serializes the operation using fs_info->unused_bgs_lock. The bundle identifies 5.15.162, 6.1.96, 6.6.36, and 6.9.7 as unaffected.
Likely exposure
Exposure is limited to Linux systems using Btrfs on a vulnerable kernel, particularly systems performing block-group relocation under low-space conditions. The vector requires local access with low privileges and no user interaction. The supplied version data does not clearly define every affected release or vendor backport, so package-level verification is necessary.
Exploitation context
The source bundle does not establish active exploitation, and this CVE is not marked as CISA KEV. It documents reproduction through the Btrfs regression test btrfs/166 and a practical trigger involving relocation failure from insufficient chunk space. No public weaponization evidence is provided.
Researcher notes
The demonstrated consequence is kernel list corruption followed by an invalid-opcode BUG in btrfs_delete_unused_bgs. The race arises after removal from the reclaim list while relocation work permits parallel unused-list insertion. The fix adds unused_bgs_lock protection. The separate retry-list logic in btrfs_delete_unused_bgs is described as safe because groups_sem is held for writing.
Mitigation direction
- Upgrade to a vendor-supported kernel containing the linked stable fix or an equivalent backport.
- Prioritize Btrfs hosts exposed to untrusted local users or storage-intensive workloads.
- Follow distribution guidance before relying solely on upstream version numbers.
- Maintain adequate Btrfs free space as risk reduction, not as a substitute for patching.
Validation and detection
- Inventory kernel versions and identify systems with mounted Btrfs filesystems.
- Confirm each kernel package contains a linked fix commit or documented vendor backport.
- Review kernel logs for Btrfs relocation errors, list corruption, kernel BUGs, or ENOSPC events.
- Validate Btrfs relocation and low-space behavior in staging after updating.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-42103 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/522b39bd7163e8dc49f8cf10b9b782218ac48746CVE reference, Linux
- https://git.kernel.org/stable/c/aa1d8cc0cc500e06b316cd6732d4e6c1388fe33cCVE reference, Linux
- https://git.kernel.org/stable/c/f8e960be923f74a273c62478c9cab9523936752bCVE reference, Linux
- https://git.kernel.org/stable/c/326fa14549d7969ef80d3f5beea5470cd1c8e67fCVE reference, Linux
- https://git.kernel.org/stable/c/48f091fd50b2eb33ae5eaea9ed3c4f81603acf38CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.