Security readout for executives and security teams
Plain-English summary
A race during Btrfs filesystem unmount can let a worker access memory belonging to an already-stopped kernel thread. The reported result is a kernel crash detected by KASAN. Because this occurs inside the Linux kernel, successful triggering could seriously affect system security or availability, although the supplied evidence does not demonstrate practical exploitation beyond the crash.
Executive priority
Treat this as a high-priority kernel update for Btrfs hosts, especially multi-user or multi-tenant systems. It is less urgent for systems that do not use Btrfs. Current evidence supports a local kernel memory-safety failure, not active exploitation or an internet-scale remote threat.
Technical view
In close_ctree(), the Btrfs cleaner thread was stopped and its task structure freed before outstanding fixup work completed. A fixup worker performing delayed inode cleanup could then wake the freed cleaner task, causing a slab use-after-free. The correction drains fixup workers and pending delayed inode operations before stopping the cleaner thread.
Likely exposure
Exposure is limited to systems running an affected Linux kernel and using Btrfs. Triggering requires local access according to the CVSS vector and the relevant unmount concurrency. The supplied version data contains commit identifiers, release versions, and distribution backports, so administrators should verify their exact packaged kernel with its vendor.
Exploitation context
Syzbot reproduced a KASAN-detected use-after-free and kernel crash. The CVSS 3.1 score is 7.8 with local, low-privilege, no-interaction characteristics. The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation, a public weaponized exploit, or remote reachability.
Researcher notes
The vulnerable ordering parks and stops the cleaner before btrfs_stop_all_workers() drains work queues. The fix specifically waits for fixup workers and processes delayed inode releases before kthread_stop(). The bundle supplies no CWE classification and no evidence establishing reliable confidentiality or integrity impact in practice.
Mitigation direction
- Install a vendor-supported kernel containing the applicable Btrfs fix or backport.
- Use the cited stable-kernel commits to confirm that a vendor build includes the correction.
- Prioritize affected Btrfs systems that permit untrusted or multi-tenant local workloads.
- If immediate updating is impossible, consult the distribution vendor for supported temporary mitigations.
Validation and detection
- Inventory kernel package versions and identify hosts where Btrfs is enabled or mounted.
- Map each packaged kernel to vendor advisories or the cited stable fix commits.
- After updating, verify the running kernel matches the installed corrected package.
- Review kernel logs for Btrfs crashes or KASAN slab-use-after-free reports during unmount.
- Test representative Btrfs unmount workloads in staging before broad deployment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-49867 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a71349b692ab34ea197949e13e3cc42570fe73d9CVE reference, Linux
- https://git.kernel.org/stable/c/70b60c8d9b42763d6629e44f448aa5d8ae477d61CVE reference, Linux
- https://git.kernel.org/stable/c/4c98fe0dfa2ae83c4631699695506d8941db4bfeCVE reference, Linux
- https://git.kernel.org/stable/c/9da40aea63f8769f28afb91aea0fac4cf6fbbb65CVE reference, Linux
- https://git.kernel.org/stable/c/ed87190e9d9c80aad220fb6b0b03a84d22e2c95bCVE reference, Linux
- https://git.kernel.org/stable/c/bf0de0f9a0544c11f96f93206da04ab87dcea1f4CVE reference, Linux
- https://git.kernel.org/stable/c/65d11eb276836d49003a8060cf31fa2284ad1047CVE reference, Linux
- https://git.kernel.org/stable/c/41fd1e94066a815a7ab0a7025359e9b40e4b3576CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.