Security readout for executives and security teams
Plain-English summary
A memory-safety flaw in the Linux Btrfs filesystem can leave a freed reference in an internal tree. Later cleanup may access that stale entry, potentially crashing the kernel or enabling broader compromise. The supplied CVSS score is 7.8 and requires local, low-privileged access; no user interaction is required.
Executive priority
Treat this as a high-priority kernel maintenance issue for Btrfs-dependent or multi-user systems. It is not presented as an internet-remote vulnerability, and active exploitation is unsubstantiated. Accelerate normal kernel patching where untrusted users or workloads have local access; otherwise remediate through the next controlled maintenance window.
Technical view
An unexpected BTRFS_DROP_DELAYED_REF action makes btrfs_ref_tree_mod() free a newly inserted reference without first removing it from the block entry's red-black tree. btrfs_free_ref_cache() later traverses that dangling pointer, causing a use-after-free. The upstream fix removes the reference from the tree before freeing it.
Likely exposure
Exposure is concentrated on systems running affected Linux kernels where Btrfs code is present and exercised. The supplied version list is ambiguous and distributions may backport fixes, so kernel version strings alone are insufficient. Confirm remediation through distributor package advisories or the referenced stable-kernel commits.
Exploitation context
The CVSS vector describes a local, low-complexity attack requiring low privileges, with potential confidentiality, integrity, and availability impact. The source bundle marks KEV false and provides no evidence of active exploitation or a public weaponized exploit. Syzbot demonstrated the faulty condition during kernel testing.
Researcher notes
This is CWE-416 in Btrfs reference-verification error handling. The dangling red-black-tree entry is consumed during cache cleanup. Multiple stable-branch commits are supplied, indicating backports across maintained kernel lines. The bundle does not establish practical privilege escalation, exploit reliability, or affected configuration prerequisites beyond the implicated Btrfs path.
Mitigation direction
- Install a distributor-supported kernel containing the CVE fix, then boot into that kernel.
- Prioritize Btrfs hosts accessible to untrusted or low-privileged local users.
- Match distributor backports against the referenced stable-kernel commits, not version numbers alone.
- If immediate updating is impossible, consult vendor guidance for supported temporary risk-reduction measures.
Validation and detection
- Inventory running kernel versions and identify systems using Btrfs filesystems.
- Check kernel package changelogs or advisories for CVE-2024-56581 or the referenced commits.
- After updating, verify each host is running the remediated kernel, not merely storing it.
- Review kernel logs for abnormal Btrfs reference-action errors or memory-safety reports.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-56581 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9CISA-ADPCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H15.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7HighVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/dfb9fe7de61f34cc241ab3900bdde93341096e0eCVE reference, Linux
- https://git.kernel.org/stable/c/6fd018aa168e472ce35be32296d109db6adb87eaCVE reference, Linux
- https://git.kernel.org/stable/c/d2b85ce0561fde894e28fa01bd5d32820d585006CVE reference, Linux
- https://git.kernel.org/stable/c/6370db28af9a8ae3bbdfe97f8a48f8f995e144cfCVE reference, Linux
- https://git.kernel.org/stable/c/4275ac2741941c9c7c2293619fdbacb9f70ba85bCVE reference, Linux
- https://git.kernel.org/stable/c/a6f9e7a0bf1185c9070c0de03bb85eafb9abd650CVE reference, Linux
- https://git.kernel.org/stable/c/7c4e39f9d2af4abaf82ca0e315d1fd340456620fCVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00001.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use After Free
Use After Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.