Security readout for executives and security teams
Plain-English summary
This is a Linux kernel Btrfs bug that can crash a system under specific filesystem writeback conditions. The business impact is availability, not data theft or privilege escalation based on the supplied sources. Risk is most relevant where affected kernels use Btrfs, especially 4K block size on 64K page-size systems.
Executive priority
Prioritize patching for Btrfs-backed Linux systems where downtime would be material. This is not presented as remote compromise, but a kernel panic can still disrupt production workloads and storage reliability.
Technical view
Btrfs can double-account ordered extents after btrfs_run_delalloc_range() fails, leading to bad ordered extent accounting, NULL pointer dereference, and kernel panic. CVSS is 5.5 with local attack vector, low privileges, no user interaction, and high availability impact.
Likely exposure
Linux systems running affected kernel builds with Btrfs enabled are the likely exposure. The source highlights 4K block size with 64K page size on aarch64 as a high-probability crash scenario. Internet-facing exposure is not indicated; local workload or user access is required by the CVSS vector.
Exploitation context
The bundle does not show active exploitation, and KEV is false. The public description demonstrates crashes during filesystem testing, not a weaponized exploit. Treat this as a local denial-of-service risk until vendor advisories or distribution backports clarify exploitability in deployed kernels.
Researcher notes
Evidence supports a Btrfs availability flaw tied to delalloc failure handling and ordered extent accounting. The affected-version data in the bundle appears partially normalized or incomplete, so rely on distribution advisories and commit inclusion checks for exact package-level exposure.
Mitigation direction
- Update affected Linux kernels through vendor or stable-kernel channels.
- Confirm whether referenced stable commits are included in deployed kernel packages.
- Prioritize Btrfs hosts using 4K sectors on 64K page-size systems.
- Review vendor guidance before changing filesystem configuration or disabling Btrfs.
- Schedule maintenance because remediation likely requires kernel update and reboot.
Validation and detection
- Inventory Linux kernel versions on systems using Btrfs.
- Identify hosts with 64K page-size architectures and 4K Btrfs sectors.
- Check vendor changelogs for CVE-2024-58089 or the referenced commits.
- Verify post-update kernels include the Btrfs ordered-extent accounting fix.
- Monitor logs for Btrfs ordered extent accounting warnings or kernel panics.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-770: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-58089 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/21333148b5c9e52f41fafcedec3810b56a5e0e40CVE reference, Linux
- https://git.kernel.org/stable/c/0283ee1912c8e243c931f4ee5b3672e954fe0384CVE reference, Linux
- https://git.kernel.org/stable/c/72dad8e377afa50435940adfb697e070d3556670CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.