Security readout for executives and security teams
Plain-English summary
A Linux Btrfs error-handling flaw can free storage-I/O memory while another operation still uses it. This can cause kernel memory corruption, crashes, or potentially broader compromise. Exploitation requires local, low-privileged access and a particular Btrfs read-error condition; the supplied evidence does not establish remote or active exploitation.
Executive priority
Treat this as a high-priority kernel maintenance issue for Btrfs systems, especially multi-user or shared-compute hosts. Patch through supported distribution channels after normal compatibility testing. Systems without Btrfs are unlikely to reach the vulnerable path. There is no supplied evidence requiring emergency incident-response measures for active exploitation.
Technical view
During a split Btrfs read, failure while mapping a later chunk can prematurely complete and free the original bio. Completion of an already-submitted chunk then accesses the freed bio and may free it again. The kernel fix routes the error through split-bio-aware original completion handling. CVSS 3.1 is 7.8: local, low complexity, low privileges, no user interaction, with high potential impact.
Likely exposure
Exposure is limited to affected Linux kernels on systems using Btrfs, particularly where reads cross stripes and a later block-mapping operation fails. The bundle identifies versions including 6.3, 6.6.49, 6.10.8, and 6.11 as affected, but its version data is ambiguous. Confirm distribution-specific status rather than relying solely on upstream version numbers.
Exploitation context
The supplied CVSS vector requires local access and low privileges. The original issue was detected through KASAN and reportedly could not be reproduced by the fixing author. No supplied source demonstrates public exploitation, and the CVE is not identified as being in CISA KEV. Trigger reliability and practical exploitability therefore remain unconfirmed.
Researcher notes
The vulnerable sequence involves a read bio split across stripes, successful submission of one segment, failure mapping a later segment, premature original-bio release, and subsequent completion against freed memory. The report supports a genuine use-after-free and double-free condition, although its author could not reproduce it. Exact introduction and fixed-version boundaries should be derived from the cited commits and distribution advisories.
Mitigation direction
- Install a vendor-supported kernel containing the applicable upstream Btrfs fix.
- Prioritize Btrfs hosts accessible to untrusted or low-privileged local users.
- Follow distribution advisories because backported fixes may not match upstream version numbers.
- Where immediate patching is impossible, restrict unnecessary local access and monitor affected hosts closely.
Validation and detection
- Inventory running kernel versions and identify hosts with mounted or configured Btrfs filesystems.
- Check vendor advisories or kernel changelogs for the cited upstream fix commits.
- Verify patched hosts booted into the updated kernel, not merely installed it.
- Review kernel logs for Btrfs errors, use-after-free reports, KASAN findings, or unexplained crashes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-46687 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/51722b99f41f5e722ffa10b8f61e802a0e70b331CVE reference, Linux
- https://git.kernel.org/stable/c/4a3b9e1a8e6cd1a8d427a905e159de58d38941ccCVE reference, Linux
- https://git.kernel.org/stable/c/10d9d8c3512f16cad47b2ff81ec6fc4b27d8ee10CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.