CVE-2024-42103 (GCVE-0-2024-42103)
Vulnerability from cvelistv5
Published
2024-07-30 07:45
Modified
2026-08-05 11:35
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix adding block group to a reclaim list and the unused list during reclaim There is a potential parallel list adding for retrying in btrfs_reclaim_bgs_work and adding to the unused list. Since the block group is removed from the reclaim list and it is on a relocation work, it can be added into the unused list in parallel. When that happens, adding it to the reclaim list will corrupt the list head and trigger list corruption like below. Fix it by taking fs_info->unused_bgs_lock. [177.504][T2585409] BTRFS error (device nullb1): error relocating ch= unk 2415919104 [177.514][T2585409] list_del corruption. next->prev should be ff1100= 0344b119c0, but was ff11000377e87c70. (next=3Dff110002390cd9c0) [177.529][T2585409] ------------[ cut here ]------------ [177.537][T2585409] kernel BUG at lib/list_debug.c:65! [177.545][T2585409] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI [177.555][T2585409] CPU: 9 PID: 2585409 Comm: kworker/u128:2 Tainted: G W 6.10.0-rc5-kts #1 [177.568][T2585409] Hardware name: Supermicro SYS-520P-WTR/X12SPW-TF, BIOS 1.2 02/14/2022 [177.579][T2585409] Workqueue: events_unbound btrfs_reclaim_bgs_work[btrfs] [177.589][T2585409] RIP: 0010:__list_del_entry_valid_or_report.cold+0x70/0x72 [177.624][T2585409] RSP: 0018:ff11000377e87a70 EFLAGS: 00010286 [177.633][T2585409] RAX: 000000000000006d RBX: ff11000344b119c0 RCX:0000000000000000 [177.644][T2585409] RDX: 000000000000006d RSI: 0000000000000008 RDI:ffe21c006efd0f40 [177.655][T2585409] RBP: ff110002e0509f78 R08: 0000000000000001 R09:ffe21c006efd0f08 [177.665][T2585409] R10: ff11000377e87847 R11: 0000000000000000 R12:ff110002390cd9c0 [177.676][T2585409] R13: ff11000344b119c0 R14: ff110002e0508000 R15:dffffc0000000000 [177.687][T2585409] FS: 0000000000000000(0000) GS:ff11000fec880000(0000) knlGS:0000000000000000 [177.700][T2585409] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [177.709][T2585409] CR2: 00007f06bc7b1978 CR3: 0000001021e86005 CR4:0000000000771ef0 [177.720][T2585409] DR0: 0000000000000000 DR1: 0000000000000000 DR2:0000000000000000 [177.731][T2585409] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:0000000000000400 [177.742][T2585409] PKRU: 55555554 [177.748][T2585409] Call Trace: [177.753][T2585409] <TASK> [177.759][T2585409] ? __die_body.cold+0x19/0x27 [177.766][T2585409] ? die+0x2e/0x50 [177.772][T2585409] ? do_trap+0x1ea/0x2d0 [177.779][T2585409] ? __list_del_entry_valid_or_report.cold+0x70/0x72 [177.788][T2585409] ? do_error_trap+0xa3/0x160 [177.795][T2585409] ? __list_del_entry_valid_or_report.cold+0x70/0x72 [177.805][T2585409] ? handle_invalid_op+0x2c/0x40 [177.812][T2585409] ? __list_del_entry_valid_or_report.cold+0x70/0x72 [177.820][T2585409] ? exc_invalid_op+0x2d/0x40 [177.827][T2585409] ? asm_exc_invalid_op+0x1a/0x20 [177.834][T2585409] ? __list_del_entry_valid_or_report.cold+0x70/0x72 [177.843][T2585409] btrfs_delete_unused_bgs+0x3d9/0x14c0 [btrfs] There is a similar retry_list code in btrfs_delete_unused_bgs(), but it is safe, AFAICS. Since the block group was in the unused list, the used bytes should be 0 when it was added to the unused list. Then, it checks block_group->{used,reserved,pinned} are still 0 under the block_group->lock. So, they should be still eligible for the unused list, not the reclaim list. The reason it is safe there it's because because we're holding space_info->groups_sem in write mode. That means no other task can allocate from the block group, so while we are at deleted_unused_bgs() it's not possible for other tasks to allocate and deallocate extents from the block group, so it can't be added to the unused list or the reclaim list by anyone else. The bug can be reproduced by btrfs/166 after a few rounds. In practice this can be hit when relocation cannot find more chunk space and ends with ENOSPC.
References
Impacted products
Vendor Product Version
Linux Linux Version: 2311fd03027d2c1b2ac4a3a41153a16352659b65
Version: 15cb476ceb7da730857b8e94f06161273adb7a3a
Version: bf1e8c21f2bef7dfcdadc93b0bb2e8723639d5f7
Version: ab58fe210c40e582a9fd3d122ae21071adb5470a
Version: 4eb4e85c4f818491efc67e9373aa16b123c3f522
 Create a notification for this product.
   Linux Linux Version: 5.15.162   ≤
Version: 6.1.96   ≤
Version: 6.6.36   ≤
Version: 6.9.7   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:01:38.141Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/522b39bd7163e8dc49f8cf10b9b782218ac48746"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/aa1d8cc0cc500e06b316cd6732d4e6c1388fe33c"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f8e960be923f74a273c62478c9cab9523936752b"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/326fa14549d7969ef80d3f5beea5470cd1c8e67f"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/48f091fd50b2eb33ae5eaea9ed3c4f81603acf38"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-42103",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:17:56.057327Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:32:49.448Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/block-group.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "522b39bd7163e8dc49f8cf10b9b782218ac48746",
              "status": "affected",
              "version": "2311fd03027d2c1b2ac4a3a41153a16352659b65",
              "versionType": "git"
            },
            {
              "lessThan": "aa1d8cc0cc500e06b316cd6732d4e6c1388fe33c",
              "status": "affected",
              "version": "15cb476ceb7da730857b8e94f06161273adb7a3a",
              "versionType": "git"
            },
            {
              "lessThan": "f8e960be923f74a273c62478c9cab9523936752b",
              "status": "affected",
              "version": "bf1e8c21f2bef7dfcdadc93b0bb2e8723639d5f7",
              "versionType": "git"
            },
            {
              "lessThan": "326fa14549d7969ef80d3f5beea5470cd1c8e67f",
              "status": "affected",
              "version": "ab58fe210c40e582a9fd3d122ae21071adb5470a",
              "versionType": "git"
            },
            {
              "lessThan": "48f091fd50b2eb33ae5eaea9ed3c4f81603acf38",
              "status": "affected",
              "version": "4eb4e85c4f818491efc67e9373aa16b123c3f522",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/block-group.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5.15.163",
              "status": "affected",
              "version": "5.15.162",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.98",
              "status": "affected",
              "version": "6.1.96",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.39",
              "status": "affected",
              "version": "6.6.36",
              "versionType": "semver"
            },
            {
              "lessThan": "6.9.9",
              "status": "affected",
              "version": "6.9.7",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.163",
                  "versionStartIncluding": "5.15.162",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.98",
                  "versionStartIncluding": "6.1.96",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.39",
                  "versionStartIncluding": "6.6.36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.9",
                  "versionStartIncluding": "6.9.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix adding block group to a reclaim list and the unused list during reclaim\n\nThere is a potential parallel list adding for retrying in\nbtrfs_reclaim_bgs_work and adding to the unused list. Since the block\ngroup is removed from the reclaim list and it is on a relocation work,\nit can be added into the unused list in parallel. When that happens,\nadding it to the reclaim list will corrupt the list head and trigger\nlist corruption like below.\n\nFix it by taking fs_info-\u003eunused_bgs_lock.\n\n  [177.504][T2585409] BTRFS error (device nullb1): error relocating ch= unk 2415919104\n  [177.514][T2585409] list_del corruption. next-\u003eprev should be ff1100= 0344b119c0, but was ff11000377e87c70. (next=3Dff110002390cd9c0)\n  [177.529][T2585409] ------------[ cut here ]------------\n  [177.537][T2585409] kernel BUG at lib/list_debug.c:65!\n  [177.545][T2585409] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI\n  [177.555][T2585409] CPU: 9 PID: 2585409 Comm: kworker/u128:2 Tainted: G        W          6.10.0-rc5-kts #1\n  [177.568][T2585409] Hardware name: Supermicro SYS-520P-WTR/X12SPW-TF, BIOS 1.2 02/14/2022\n  [177.579][T2585409] Workqueue: events_unbound btrfs_reclaim_bgs_work[btrfs]\n  [177.589][T2585409] RIP: 0010:__list_del_entry_valid_or_report.cold+0x70/0x72\n  [177.624][T2585409] RSP: 0018:ff11000377e87a70 EFLAGS: 00010286\n  [177.633][T2585409] RAX: 000000000000006d RBX: ff11000344b119c0 RCX:0000000000000000\n  [177.644][T2585409] RDX: 000000000000006d RSI: 0000000000000008 RDI:ffe21c006efd0f40\n  [177.655][T2585409] RBP: ff110002e0509f78 R08: 0000000000000001 R09:ffe21c006efd0f08\n  [177.665][T2585409] R10: ff11000377e87847 R11: 0000000000000000 R12:ff110002390cd9c0\n  [177.676][T2585409] R13: ff11000344b119c0 R14: ff110002e0508000 R15:dffffc0000000000\n  [177.687][T2585409] FS:  0000000000000000(0000) GS:ff11000fec880000(0000) knlGS:0000000000000000\n  [177.700][T2585409] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [177.709][T2585409] CR2: 00007f06bc7b1978 CR3: 0000001021e86005 CR4:0000000000771ef0\n  [177.720][T2585409] DR0: 0000000000000000 DR1: 0000000000000000 DR2:0000000000000000\n  [177.731][T2585409] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:0000000000000400\n  [177.742][T2585409] PKRU: 55555554\n  [177.748][T2585409] Call Trace:\n  [177.753][T2585409]  \u003cTASK\u003e\n  [177.759][T2585409]  ? __die_body.cold+0x19/0x27\n  [177.766][T2585409]  ? die+0x2e/0x50\n  [177.772][T2585409]  ? do_trap+0x1ea/0x2d0\n  [177.779][T2585409]  ? __list_del_entry_valid_or_report.cold+0x70/0x72\n  [177.788][T2585409]  ? do_error_trap+0xa3/0x160\n  [177.795][T2585409]  ? __list_del_entry_valid_or_report.cold+0x70/0x72\n  [177.805][T2585409]  ? handle_invalid_op+0x2c/0x40\n  [177.812][T2585409]  ? __list_del_entry_valid_or_report.cold+0x70/0x72\n  [177.820][T2585409]  ? exc_invalid_op+0x2d/0x40\n  [177.827][T2585409]  ? asm_exc_invalid_op+0x1a/0x20\n  [177.834][T2585409]  ? __list_del_entry_valid_or_report.cold+0x70/0x72\n  [177.843][T2585409]  btrfs_delete_unused_bgs+0x3d9/0x14c0 [btrfs]\n\nThere is a similar retry_list code in btrfs_delete_unused_bgs(), but it is\nsafe, AFAICS. Since the block group was in the unused list, the used bytes\nshould be 0 when it was added to the unused list. Then, it checks\nblock_group-\u003e{used,reserved,pinned} are still 0 under the\nblock_group-\u003elock. So, they should be still eligible for the unused list,\nnot the reclaim list.\n\nThe reason it is safe there it\u0027s because because we\u0027re holding\nspace_info-\u003egroups_sem in write mode.\n\nThat means no other task can allocate from the block group, so while we\nare at deleted_unused_bgs() it\u0027s not possible for other tasks to\nallocate and deallocate extents from the block group, so it can\u0027t be\nadded to the unused list or the reclaim list by anyone else.\n\nThe bug can be reproduced by btrfs/166 after a few rounds. In practice\nthis can be hit when relocation cannot find more chunk space and ends\nwith ENOSPC."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The race is driven entirely through local filesystem I/O (writes, deletes, fallocate) on a mounted btrfs volume; there is no network-facing component in the block-group reclaim path.\nAC:L - The attacker drives both sides of the race with ordinary file operations \u2014 freeing extents empties the block group (firing btrfs_mark_bg_unused) exactly while the reclaim worker is in the long btrfs_relocate_chunk() window, and filling the filesystem reliably forces the ENOSPC return that reaches the unlocked list_add_tail; the upstream reproducer (btrfs/166) hits it within a few rounds.\nPR:L - Only write access to a mounted btrfs filesystem is needed (e.g. a home directory or /tmp on btrfs); the reclaim and unused-bg workers are background kthreads with no capability check on the triggering path.\nUI:N - No victim action is required \u2014 the attacker\u0027s own file operations queue the reclaim work and race it; the filesystem being mounted is a pre-existing system state, not an interaction.\nS:U - The corruption is confined to kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The same list_head ends up on a global list and on the worker\u0027s stack-resident retry_list, and the double list removal underflows the block-group refcount into a use-after-free of struct btrfs_block_group, giving read access to freed/heap-sprayed and kernel-stack memory.\nI:H - Cross-list corruption makes list_del() write attacker-influenced pointers into the reclaim worker\u0027s kernel stack, and the refcount underflow yields a UAF on a slab object \u2014 both are exploitable write primitives for control-flow hijack.\nA:H - The observed outcome is a hard kernel BUG()/oops in __list_del_entry_valid_or_report() from btrfs_delete_unused_bgs; without CONFIG_DEBUG_LIST the corrupted list causes a self-referencing loop and use-after-free that panic the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:35:36.824Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/522b39bd7163e8dc49f8cf10b9b782218ac48746"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa1d8cc0cc500e06b316cd6732d4e6c1388fe33c"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8e960be923f74a273c62478c9cab9523936752b"
        },
        {
          "url": "https://git.kernel.org/stable/c/326fa14549d7969ef80d3f5beea5470cd1c8e67f"
        },
        {
          "url": "https://git.kernel.org/stable/c/48f091fd50b2eb33ae5eaea9ed3c4f81603acf38"
        }
      ],
      "title": "btrfs: fix adding block group to a reclaim list and the unused list during reclaim",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-42103",
    "datePublished": "2024-07-30T07:45:59.220Z",
    "dateReserved": "2024-07-29T15:50:41.175Z",
    "dateUpdated": "2026-08-05T11:35:36.824Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/522b39bd7163e8dc49f8cf10b9b782218ac48746\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/aa1d8cc0cc500e06b316cd6732d4e6c1388fe33c\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/f8e960be923f74a273c62478c9cab9523936752b\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/326fa14549d7969ef80d3f5beea5470cd1c8e67f\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/48f091fd50b2eb33ae5eaea9ed3c4f81603acf38\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:01:38.141Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-42103\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:17:56.057327Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:12.815Z\"}}], \"cna\": {\"title\": \"btrfs: fix adding block group to a reclaim list and the unused list during reclaim\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The race is driven entirely through local filesystem I/O (writes, deletes, fallocate) on a mounted btrfs volume; there is no network-facing component in the block-group reclaim path.\\nAC:L - The attacker drives both sides of the race with ordinary file operations \\u2014 freeing extents empties the block group (firing btrfs_mark_bg_unused) exactly while the reclaim worker is in the long btrfs_relocate_chunk() window, and filling the filesystem reliably forces the ENOSPC return that reaches the unlocked list_add_tail; the upstream reproducer (btrfs/166) hits it within a few rounds.\\nPR:L - Only write access to a mounted btrfs filesystem is needed (e.g. a home directory or /tmp on btrfs); the reclaim and unused-bg workers are background kthreads with no capability check on the triggering path.\\nUI:N - No victim action is required \\u2014 the attacker\u0027s own file operations queue the reclaim work and race it; the filesystem being mounted is a pre-existing system state, not an interaction.\\nS:U - The corruption is confined to kernel memory within the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - The same list_head ends up on a global list and on the worker\u0027s stack-resident retry_list, and the double list removal underflows the block-group refcount into a use-after-free of struct btrfs_block_group, giving read access to freed/heap-sprayed and kernel-stack memory.\\nI:H - Cross-list corruption makes list_del() write attacker-influenced pointers into the reclaim worker\u0027s kernel stack, and the refcount underflow yields a UAF on a slab object \\u2014 both are exploitable write primitives for control-flow hijack.\\nA:H - The observed outcome is a hard kernel BUG()/oops in __list_del_entry_valid_or_report() from btrfs_delete_unused_bgs; without CONFIG_DEBUG_LIST the corrupted list causes a self-referencing loop and use-after-free that panic the kernel.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2311fd03027d2c1b2ac4a3a41153a16352659b65\", \"lessThan\": \"522b39bd7163e8dc49f8cf10b9b782218ac48746\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"15cb476ceb7da730857b8e94f06161273adb7a3a\", \"lessThan\": \"aa1d8cc0cc500e06b316cd6732d4e6c1388fe33c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"bf1e8c21f2bef7dfcdadc93b0bb2e8723639d5f7\", \"lessThan\": \"f8e960be923f74a273c62478c9cab9523936752b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"ab58fe210c40e582a9fd3d122ae21071adb5470a\", \"lessThan\": \"326fa14549d7969ef80d3f5beea5470cd1c8e67f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"4eb4e85c4f818491efc67e9373aa16b123c3f522\", \"lessThan\": \"48f091fd50b2eb33ae5eaea9ed3c4f81603acf38\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/btrfs/block-group.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.15.162\", \"lessThan\": \"5.15.163\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.1.96\", \"lessThan\": \"6.1.98\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.6.36\", \"lessThan\": \"6.6.39\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"6.9.7\", \"lessThan\": \"6.9.9\", \"versionType\": \"semver\"}], \"programFiles\": [\"fs/btrfs/block-group.c\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/522b39bd7163e8dc49f8cf10b9b782218ac48746\"}, {\"url\": \"https://git.kernel.org/stable/c/aa1d8cc0cc500e06b316cd6732d4e6c1388fe33c\"}, {\"url\": \"https://git.kernel.org/stable/c/f8e960be923f74a273c62478c9cab9523936752b\"}, {\"url\": \"https://git.kernel.org/stable/c/326fa14549d7969ef80d3f5beea5470cd1c8e67f\"}, {\"url\": \"https://git.kernel.org/stable/c/48f091fd50b2eb33ae5eaea9ed3c4f81603acf38\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix adding block group to a reclaim list and the unused list during reclaim\\n\\nThere is a potential parallel list adding for retrying in\\nbtrfs_reclaim_bgs_work and adding to the unused list. Since the block\\ngroup is removed from the reclaim list and it is on a relocation work,\\nit can be added into the unused list in parallel. When that happens,\\nadding it to the reclaim list will corrupt the list head and trigger\\nlist corruption like below.\\n\\nFix it by taking fs_info-\u003eunused_bgs_lock.\\n\\n  [177.504][T2585409] BTRFS error (device nullb1): error relocating ch= unk 2415919104\\n  [177.514][T2585409] list_del corruption. next-\u003eprev should be ff1100= 0344b119c0, but was ff11000377e87c70. (next=3Dff110002390cd9c0)\\n  [177.529][T2585409] ------------[ cut here ]------------\\n  [177.537][T2585409] kernel BUG at lib/list_debug.c:65!\\n  [177.545][T2585409] Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI\\n  [177.555][T2585409] CPU: 9 PID: 2585409 Comm: kworker/u128:2 Tainted: G        W          6.10.0-rc5-kts #1\\n  [177.568][T2585409] Hardware name: Supermicro SYS-520P-WTR/X12SPW-TF, BIOS 1.2 02/14/2022\\n  [177.579][T2585409] Workqueue: events_unbound btrfs_reclaim_bgs_work[btrfs]\\n  [177.589][T2585409] RIP: 0010:__list_del_entry_valid_or_report.cold+0x70/0x72\\n  [177.624][T2585409] RSP: 0018:ff11000377e87a70 EFLAGS: 00010286\\n  [177.633][T2585409] RAX: 000000000000006d RBX: ff11000344b119c0 RCX:0000000000000000\\n  [177.644][T2585409] RDX: 000000000000006d RSI: 0000000000000008 RDI:ffe21c006efd0f40\\n  [177.655][T2585409] RBP: ff110002e0509f78 R08: 0000000000000001 R09:ffe21c006efd0f08\\n  [177.665][T2585409] R10: ff11000377e87847 R11: 0000000000000000 R12:ff110002390cd9c0\\n  [177.676][T2585409] R13: ff11000344b119c0 R14: ff110002e0508000 R15:dffffc0000000000\\n  [177.687][T2585409] FS:  0000000000000000(0000) GS:ff11000fec880000(0000) knlGS:0000000000000000\\n  [177.700][T2585409] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n  [177.709][T2585409] CR2: 00007f06bc7b1978 CR3: 0000001021e86005 CR4:0000000000771ef0\\n  [177.720][T2585409] DR0: 0000000000000000 DR1: 0000000000000000 DR2:0000000000000000\\n  [177.731][T2585409] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:0000000000000400\\n  [177.742][T2585409] PKRU: 55555554\\n  [177.748][T2585409] Call Trace:\\n  [177.753][T2585409]  \u003cTASK\u003e\\n  [177.759][T2585409]  ? __die_body.cold+0x19/0x27\\n  [177.766][T2585409]  ? die+0x2e/0x50\\n  [177.772][T2585409]  ? do_trap+0x1ea/0x2d0\\n  [177.779][T2585409]  ? __list_del_entry_valid_or_report.cold+0x70/0x72\\n  [177.788][T2585409]  ? do_error_trap+0xa3/0x160\\n  [177.795][T2585409]  ? __list_del_entry_valid_or_report.cold+0x70/0x72\\n  [177.805][T2585409]  ? handle_invalid_op+0x2c/0x40\\n  [177.812][T2585409]  ? __list_del_entry_valid_or_report.cold+0x70/0x72\\n  [177.820][T2585409]  ? exc_invalid_op+0x2d/0x40\\n  [177.827][T2585409]  ? asm_exc_invalid_op+0x1a/0x20\\n  [177.834][T2585409]  ? __list_del_entry_valid_or_report.cold+0x70/0x72\\n  [177.843][T2585409]  btrfs_delete_unused_bgs+0x3d9/0x14c0 [btrfs]\\n\\nThere is a similar retry_list code in btrfs_delete_unused_bgs(), but it is\\nsafe, AFAICS. Since the block group was in the unused list, the used bytes\\nshould be 0 when it was added to the unused list. Then, it checks\\nblock_group-\u003e{used,reserved,pinned} are still 0 under the\\nblock_group-\u003elock. So, they should be still eligible for the unused list,\\nnot the reclaim list.\\n\\nThe reason it is safe there it\u0027s because because we\u0027re holding\\nspace_info-\u003egroups_sem in write mode.\\n\\nThat means no other task can allocate from the block group, so while we\\nare at deleted_unused_bgs() it\u0027s not possible for other tasks to\\nallocate and deallocate extents from the block group, so it can\u0027t be\\nadded to the unused list or the reclaim list by anyone else.\\n\\nThe bug can be reproduced by btrfs/166 after a few rounds. In practice\\nthis can be hit when relocation cannot find more chunk space and ends\\nwith ENOSPC.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.163\", \"versionStartIncluding\": \"5.15.162\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.98\", \"versionStartIncluding\": \"6.1.96\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.39\", \"versionStartIncluding\": \"6.6.36\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.9\", \"versionStartIncluding\": \"6.9.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:35:36.824Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-42103\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:35:36.824Z\", \"dateReserved\": \"2024-07-29T15:50:41.175Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-30T07:45:59.220Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.