GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-49868 (GCVE-0-2024-49868)

Vulnerability from cvelistv5 – Published: 2024-10-21 18:01 – Updated: 2026-05-11 20:40
VLAI
Title
btrfs: fix a NULL pointer dereference when failed to start a new trasacntion
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion [BUG] Syzbot reported a NULL pointer dereference with the following crash: FAULT_INJECTION: forcing a failure. start_transaction+0x830/0x1670 fs/btrfs/transaction.c:676 prepare_to_relocate+0x31f/0x4c0 fs/btrfs/relocation.c:3642 relocate_block_group+0x169/0xd20 fs/btrfs/relocation.c:3678 ... BTRFS info (device loop0): balance: ended with status: -12 Oops: general protection fault, probably for non-canonical address 0xdffffc00000000cc: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000660-0x0000000000000667] RIP: 0010:btrfs_update_reloc_root+0x362/0xa80 fs/btrfs/relocation.c:926 Call Trace: <TASK> commit_fs_roots+0x2ee/0x720 fs/btrfs/transaction.c:1496 btrfs_commit_transaction+0xfaf/0x3740 fs/btrfs/transaction.c:2430 del_balance_item fs/btrfs/volumes.c:3678 [inline] reset_balance_state+0x25e/0x3c0 fs/btrfs/volumes.c:3742 btrfs_balance+0xead/0x10c0 fs/btrfs/volumes.c:4574 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f [CAUSE] The allocation failure happens at the start_transaction() inside prepare_to_relocate(), and during the error handling we call unset_reloc_control(), which makes fs_info->balance_ctl to be NULL. Then we continue the error path cleanup in btrfs_balance() by calling reset_balance_state() which will call del_balance_item() to fully delete the balance item in the root tree. However during the small window between set_reloc_contrl() and unset_reloc_control(), we can have a subvolume tree update and created a reloc_root for that subvolume. Then we go into the final btrfs_commit_transaction() of del_balance_item(), and into btrfs_update_reloc_root() inside commit_fs_roots(). That function checks if fs_info->reloc_ctl is in the merge_reloc_tree stage, but since fs_info->reloc_ctl is NULL, it results a NULL pointer dereference. [FIX] Just add extra check on fs_info->reloc_ctl inside btrfs_update_reloc_root(), before checking fs_info->reloc_ctl->merge_reloc_tree. That DEAD_RELOC_TREE handling is to prevent further modification to the reloc tree during merge stage, but since there is no reloc_ctl at all, we do not need to bother that.
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-22 13:47 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3fd0a5585eb98e074fb9934549c8d85c49756c0d , < 1282f001cbf56e5dd6e90a18e205a566793f4be0 (git)
Affected: 3fd0a5585eb98e074fb9934549c8d85c49756c0d , < d73d48acf36f57362df7e4f9d76568168bf5e944 (git)
Affected: 3fd0a5585eb98e074fb9934549c8d85c49756c0d , < 37fee9c220b92c3b7bf22b51c51dde5364e7590b (git)
Affected: 3fd0a5585eb98e074fb9934549c8d85c49756c0d , < d13249c0df7aab885acb149695f82c54c0822a70 (git)
Affected: 3fd0a5585eb98e074fb9934549c8d85c49756c0d , < 7ad0c5868f2f0418619089513d95230c66cb7eb4 (git)
Affected: 3fd0a5585eb98e074fb9934549c8d85c49756c0d , < dc02c1440705e3451abd1c2c8114a5c1bb188e9f (git)
Affected: 3fd0a5585eb98e074fb9934549c8d85c49756c0d , < 39356ec0e319ed07627b3a0f402d0608546509e6 (git)
Affected: 3fd0a5585eb98e074fb9934549c8d85c49756c0d , < c3b47f49e83197e8dffd023ec568403bcdbb774b (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.35
Unaffected: 0 , < 2.6.35 (semver)
Unaffected: 5.4.285 , ≤ 5.4.* (semver)
Unaffected: 5.10.227 , ≤ 5.10.* (semver)
Unaffected: 5.15.168 , ≤ 5.15.* (semver)
Unaffected: 6.1.113 , ≤ 6.1.* (semver)
Unaffected: 6.6.55 , ≤ 6.6.* (semver)
Unaffected: 6.10.14 , ≤ 6.10.* (semver)
Unaffected: 6.11.3 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49868",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:47:20.255256Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:48:52.367Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:22:35.952Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/relocation.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1282f001cbf56e5dd6e90a18e205a566793f4be0",
              "status": "affected",
              "version": "3fd0a5585eb98e074fb9934549c8d85c49756c0d",
              "versionType": "git"
            },
            {
              "lessThan": "d73d48acf36f57362df7e4f9d76568168bf5e944",
              "status": "affected",
              "version": "3fd0a5585eb98e074fb9934549c8d85c49756c0d",
              "versionType": "git"
            },
            {
              "lessThan": "37fee9c220b92c3b7bf22b51c51dde5364e7590b",
              "status": "affected",
              "version": "3fd0a5585eb98e074fb9934549c8d85c49756c0d",
              "versionType": "git"
            },
            {
              "lessThan": "d13249c0df7aab885acb149695f82c54c0822a70",
              "status": "affected",
              "version": "3fd0a5585eb98e074fb9934549c8d85c49756c0d",
              "versionType": "git"
            },
            {
              "lessThan": "7ad0c5868f2f0418619089513d95230c66cb7eb4",
              "status": "affected",
              "version": "3fd0a5585eb98e074fb9934549c8d85c49756c0d",
              "versionType": "git"
            },
            {
              "lessThan": "dc02c1440705e3451abd1c2c8114a5c1bb188e9f",
              "status": "affected",
              "version": "3fd0a5585eb98e074fb9934549c8d85c49756c0d",
              "versionType": "git"
            },
            {
              "lessThan": "39356ec0e319ed07627b3a0f402d0608546509e6",
              "status": "affected",
              "version": "3fd0a5585eb98e074fb9934549c8d85c49756c0d",
              "versionType": "git"
            },
            {
              "lessThan": "c3b47f49e83197e8dffd023ec568403bcdbb774b",
              "status": "affected",
              "version": "3fd0a5585eb98e074fb9934549c8d85c49756c0d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/relocation.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.35"
            },
            {
              "lessThan": "2.6.35",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.285",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.227",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.285",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.227",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.168",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.113",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.55",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.14",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.3",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "2.6.35",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix a NULL pointer dereference when failed to start a new trasacntion\n\n[BUG]\nSyzbot reported a NULL pointer dereference with the following crash:\n\n  FAULT_INJECTION: forcing a failure.\n   start_transaction+0x830/0x1670 fs/btrfs/transaction.c:676\n   prepare_to_relocate+0x31f/0x4c0 fs/btrfs/relocation.c:3642\n   relocate_block_group+0x169/0xd20 fs/btrfs/relocation.c:3678\n  ...\n  BTRFS info (device loop0): balance: ended with status: -12\n  Oops: general protection fault, probably for non-canonical address 0xdffffc00000000cc: 0000 [#1] PREEMPT SMP KASAN NOPTI\n  KASAN: null-ptr-deref in range [0x0000000000000660-0x0000000000000667]\n  RIP: 0010:btrfs_update_reloc_root+0x362/0xa80 fs/btrfs/relocation.c:926\n  Call Trace:\n   \u003cTASK\u003e\n   commit_fs_roots+0x2ee/0x720 fs/btrfs/transaction.c:1496\n   btrfs_commit_transaction+0xfaf/0x3740 fs/btrfs/transaction.c:2430\n   del_balance_item fs/btrfs/volumes.c:3678 [inline]\n   reset_balance_state+0x25e/0x3c0 fs/btrfs/volumes.c:3742\n   btrfs_balance+0xead/0x10c0 fs/btrfs/volumes.c:4574\n   btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673\n   vfs_ioctl fs/ioctl.c:51 [inline]\n   __do_sys_ioctl fs/ioctl.c:907 [inline]\n   __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893\n   do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n   do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n[CAUSE]\nThe allocation failure happens at the start_transaction() inside\nprepare_to_relocate(), and during the error handling we call\nunset_reloc_control(), which makes fs_info-\u003ebalance_ctl to be NULL.\n\nThen we continue the error path cleanup in btrfs_balance() by calling\nreset_balance_state() which will call del_balance_item() to fully delete\nthe balance item in the root tree.\n\nHowever during the small window between set_reloc_contrl() and\nunset_reloc_control(), we can have a subvolume tree update and created a\nreloc_root for that subvolume.\n\nThen we go into the final btrfs_commit_transaction() of\ndel_balance_item(), and into btrfs_update_reloc_root() inside\ncommit_fs_roots().\n\nThat function checks if fs_info-\u003ereloc_ctl is in the merge_reloc_tree\nstage, but since fs_info-\u003ereloc_ctl is NULL, it results a NULL pointer\ndereference.\n\n[FIX]\nJust add extra check on fs_info-\u003ereloc_ctl inside\nbtrfs_update_reloc_root(), before checking\nfs_info-\u003ereloc_ctl-\u003emerge_reloc_tree.\n\nThat DEAD_RELOC_TREE handling is to prevent further modification to the\nreloc tree during merge stage, but since there is no reloc_ctl at all,\nwe do not need to bother that."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:40:47.334Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1282f001cbf56e5dd6e90a18e205a566793f4be0"
        },
        {
          "url": "https://git.kernel.org/stable/c/d73d48acf36f57362df7e4f9d76568168bf5e944"
        },
        {
          "url": "https://git.kernel.org/stable/c/37fee9c220b92c3b7bf22b51c51dde5364e7590b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d13249c0df7aab885acb149695f82c54c0822a70"
        },
        {
          "url": "https://git.kernel.org/stable/c/7ad0c5868f2f0418619089513d95230c66cb7eb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc02c1440705e3451abd1c2c8114a5c1bb188e9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/39356ec0e319ed07627b3a0f402d0608546509e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3b47f49e83197e8dffd023ec568403bcdbb774b"
        }
      ],
      "title": "btrfs: fix a NULL pointer dereference when failed to start a new trasacntion",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49868",
    "datePublished": "2024-10-21T18:01:10.722Z",
    "dateReserved": "2024-10-21T12:17:06.019Z",
    "dateUpdated": "2026-05-11T20:40:47.334Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-49868",
      "date": "2026-09-16",
      "epss": "0.00288",
      "percentile": "0.21426"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"5.10.227\", \"matchCriteriaId\": \"EB525A44-6338-4857-AD90-EA2860D1AD1F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.168\", \"matchCriteriaId\": \"4D51C05D-455B-4D8D-89E7-A58E140B864C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.113\", \"matchCriteriaId\": \"D01BD22E-ACD1-4618-9D01-6116570BE1EE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.55\", \"matchCriteriaId\": \"E90B9576-56C4-47BC-AAB0-C5B2D438F5D0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.14\", \"matchCriteriaId\": \"4C16BCE0-FFA0-4599-BE0A-1FD65101C021\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.11\", \"versionEndExcluding\": \"6.11.3\", \"matchCriteriaId\": \"54D9C704-D679-41A7-9C40-10A6B1E7FFE9\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix a NULL pointer dereference when failed to start a new trasacntion\\n\\n[BUG]\\nSyzbot reported a NULL pointer dereference with the following crash:\\n\\n  FAULT_INJECTION: forcing a failure.\\n   start_transaction+0x830/0x1670 fs/btrfs/transaction.c:676\\n   prepare_to_relocate+0x31f/0x4c0 fs/btrfs/relocation.c:3642\\n   relocate_block_group+0x169/0xd20 fs/btrfs/relocation.c:3678\\n  ...\\n  BTRFS info (device loop0): balance: ended with status: -12\\n  Oops: general protection fault, probably for non-canonical address 0xdffffc00000000cc: 0000 [#1] PREEMPT SMP KASAN NOPTI\\n  KASAN: null-ptr-deref in range [0x0000000000000660-0x0000000000000667]\\n  RIP: 0010:btrfs_update_reloc_root+0x362/0xa80 fs/btrfs/relocation.c:926\\n  Call Trace:\\n   \u003cTASK\u003e\\n   commit_fs_roots+0x2ee/0x720 fs/btrfs/transaction.c:1496\\n   btrfs_commit_transaction+0xfaf/0x3740 fs/btrfs/transaction.c:2430\\n   del_balance_item fs/btrfs/volumes.c:3678 [inline]\\n   reset_balance_state+0x25e/0x3c0 fs/btrfs/volumes.c:3742\\n   btrfs_balance+0xead/0x10c0 fs/btrfs/volumes.c:4574\\n   btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673\\n   vfs_ioctl fs/ioctl.c:51 [inline]\\n   __do_sys_ioctl fs/ioctl.c:907 [inline]\\n   __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893\\n   do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n   do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n\\n[CAUSE]\\nThe allocation failure happens at the start_transaction() inside\\nprepare_to_relocate(), and during the error handling we call\\nunset_reloc_control(), which makes fs_info-\u003ebalance_ctl to be NULL.\\n\\nThen we continue the error path cleanup in btrfs_balance() by calling\\nreset_balance_state() which will call del_balance_item() to fully delete\\nthe balance item in the root tree.\\n\\nHowever during the small window between set_reloc_contrl() and\\nunset_reloc_control(), we can have a subvolume tree update and created a\\nreloc_root for that subvolume.\\n\\nThen we go into the final btrfs_commit_transaction() of\\ndel_balance_item(), and into btrfs_update_reloc_root() inside\\ncommit_fs_roots().\\n\\nThat function checks if fs_info-\u003ereloc_ctl is in the merge_reloc_tree\\nstage, but since fs_info-\u003ereloc_ctl is NULL, it results a NULL pointer\\ndereference.\\n\\n[FIX]\\nJust add extra check on fs_info-\u003ereloc_ctl inside\\nbtrfs_update_reloc_root(), before checking\\nfs_info-\u003ereloc_ctl-\u003emerge_reloc_tree.\\n\\nThat DEAD_RELOC_TREE handling is to prevent further modification to the\\nreloc tree during merge stage, but since there is no reloc_ctl at all,\\nwe do not need to bother that.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: corrige una desreferencia de puntero NULL cuando no se puede iniciar una nueva transacci\\u00f3n [ERROR] Syzbot inform\\u00f3 una desreferencia de puntero NULL con el siguiente bloqueo: FAULT_INJECTION: forzando un fallo. start_transaction+0x830/0x1670 fs/btrfs/transaction.c:676 prepare_to_relocate+0x31f/0x4c0 fs/btrfs/relocation.c:3642 relocate_block_group+0x169/0xd20 fs/btrfs/relocation.c:3678 ... Informaci\\u00f3n de BTRFS (dispositivo loop0): balance: finalizado con estado: -12 Vaya: error de protecci\\u00f3n general, probablemente para la direcci\\u00f3n no can\\u00f3nica 0xdffffc00000000cc: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref en el rango [0x000000000000660-0x0000000000000667] RIP: 0010:btrfs_update_reloc_root+0x362/0xa80 fs/btrfs/relocation.c:926 Seguimiento de llamadas:  commit_fs_roots+0x2ee/0x720 fs/btrfs/transaction.c:1496 btrfs_commit_transaction+0xfaf/0x3740 fs/btrfs/transaction.c:2430 del_balance_item fs/btrfs/volumes.c:3678 [en l\\u00ednea] reset_balance_state+0x25e/0x3c0 fs/btrfs/volumes.c:3742 btrfs_balance+0xead/0x10c0 fs/btrfs/volumes.c:4574 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f [CAUSA] El fallo de asignaci\\u00f3n ocurre en start_transaction() dentro de prepare_to_relocate(), y durante el manejo de errores llamamos a unset_reloc_control(), lo que hace que fs_info-\u0026gt;balance_ctl sea NULL. Luego continuamos con la limpieza de la ruta de error en btrfs_balance() llamando a reset_balance_state() que llamar\\u00e1 a del_balance_item() para eliminar por completo el elemento de balance en el \\u00e1rbol ra\\u00edz. Sin embargo, durante la peque\\u00f1a ventana entre set_reloc_contrl() y unset_reloc_control(), podemos tener una actualizaci\\u00f3n del \\u00e1rbol de subvolumen y crear un reloc_root para ese subvolumen. Luego pasamos a la btrfs_commit_transaction() final de del_balance_item() y a btrfs_update_reloc_root() dentro de commit_fs_roots(). Esa funci\\u00f3n verifica si fs_info-\u0026gt;reloc_ctl est\\u00e1 en la etapa merge_reloc_tree, pero dado que fs_info-\u0026gt;reloc_ctl es NULL, da como resultado una desreferencia de puntero NULL. [SOLUCI\\u00d3N] Solo hay que a\\u00f1adir una comprobaci\\u00f3n adicional en fs_info-\u0026gt;reloc_ctl dentro de btrfs_update_reloc_root(), antes de comprobar fs_info-\u0026gt;reloc_ctl-\u0026gt;merge_reloc_tree. El manejo de DEAD_RELOC_TREE sirve para evitar modificaciones adicionales del \\u00e1rbol de reubicaci\\u00f3n durante la etapa de fusi\\u00f3n, pero como no hay ning\\u00fan reloc_ctl, no tenemos que preocuparnos por eso.\"}]",
      "id": "CVE-2024-49868",
      "lastModified": "2024-11-08T16:15:29.227",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-10-21T18:15:06.623",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/1282f001cbf56e5dd6e90a18e205a566793f4be0\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/37fee9c220b92c3b7bf22b51c51dde5364e7590b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/39356ec0e319ed07627b3a0f402d0608546509e6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/7ad0c5868f2f0418619089513d95230c66cb7eb4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/c3b47f49e83197e8dffd023ec568403bcdbb774b\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d13249c0df7aab885acb149695f82c54c0822a70\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d73d48acf36f57362df7e4f9d76568168bf5e944\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/dc02c1440705e3451abd1c2c8114a5c1bb188e9f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T02:11:20.000Z",
      "cve": "CVE-2024-49868",
      "id": "msrc_CVE-2024-49868",
      "initial_release_date": "2024-10-01T07:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "btrfs: fix a NULL pointer dereference when failed to start a new trasacntion",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-49868.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-49868\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-10-21T18:15:06.623\",\"lastModified\":\"2026-06-17T08:00:37.190\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix a NULL pointer dereference when failed to start a new trasacntion\\n\\n[BUG]\\nSyzbot reported a NULL pointer dereference with the following crash:\\n\\n  FAULT_INJECTION: forcing a failure.\\n   start_transaction+0x830/0x1670 fs/btrfs/transaction.c:676\\n   prepare_to_relocate+0x31f/0x4c0 fs/btrfs/relocation.c:3642\\n   relocate_block_group+0x169/0xd20 fs/btrfs/relocation.c:3678\\n  ...\\n  BTRFS info (device loop0): balance: ended with status: -12\\n  Oops: general protection fault, probably for non-canonical address 0xdffffc00000000cc: 0000 [#1] PREEMPT SMP KASAN NOPTI\\n  KASAN: null-ptr-deref in range [0x0000000000000660-0x0000000000000667]\\n  RIP: 0010:btrfs_update_reloc_root+0x362/0xa80 fs/btrfs/relocation.c:926\\n  Call Trace:\\n   \u003cTASK\u003e\\n   commit_fs_roots+0x2ee/0x720 fs/btrfs/transaction.c:1496\\n   btrfs_commit_transaction+0xfaf/0x3740 fs/btrfs/transaction.c:2430\\n   del_balance_item fs/btrfs/volumes.c:3678 [inline]\\n   reset_balance_state+0x25e/0x3c0 fs/btrfs/volumes.c:3742\\n   btrfs_balance+0xead/0x10c0 fs/btrfs/volumes.c:4574\\n   btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673\\n   vfs_ioctl fs/ioctl.c:51 [inline]\\n   __do_sys_ioctl fs/ioctl.c:907 [inline]\\n   __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893\\n   do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n   do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n\\n[CAUSE]\\nThe allocation failure happens at the start_transaction() inside\\nprepare_to_relocate(), and during the error handling we call\\nunset_reloc_control(), which makes fs_info-\u003ebalance_ctl to be NULL.\\n\\nThen we continue the error path cleanup in btrfs_balance() by calling\\nreset_balance_state() which will call del_balance_item() to fully delete\\nthe balance item in the root tree.\\n\\nHowever during the small window between set_reloc_contrl() and\\nunset_reloc_control(), we can have a subvolume tree update and created a\\nreloc_root for that subvolume.\\n\\nThen we go into the final btrfs_commit_transaction() of\\ndel_balance_item(), and into btrfs_update_reloc_root() inside\\ncommit_fs_roots().\\n\\nThat function checks if fs_info-\u003ereloc_ctl is in the merge_reloc_tree\\nstage, but since fs_info-\u003ereloc_ctl is NULL, it results a NULL pointer\\ndereference.\\n\\n[FIX]\\nJust add extra check on fs_info-\u003ereloc_ctl inside\\nbtrfs_update_reloc_root(), before checking\\nfs_info-\u003ereloc_ctl-\u003emerge_reloc_tree.\\n\\nThat DEAD_RELOC_TREE handling is to prevent further modification to the\\nreloc tree during merge stage, but since there is no reloc_ctl at all,\\nwe do not need to bother that.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: corrige una desreferencia de puntero NULL cuando no se puede iniciar una nueva transacci\u00f3n [ERROR] Syzbot inform\u00f3 una desreferencia de puntero NULL con el siguiente bloqueo: FAULT_INJECTION: forzando un fallo. start_transaction+0x830/0x1670 fs/btrfs/transaction.c:676 prepare_to_relocate+0x31f/0x4c0 fs/btrfs/relocation.c:3642 relocate_block_group+0x169/0xd20 fs/btrfs/relocation.c:3678 ... Informaci\u00f3n de BTRFS (dispositivo loop0): balance: finalizado con estado: -12 Vaya: error de protecci\u00f3n general, probablemente para la direcci\u00f3n no can\u00f3nica 0xdffffc00000000cc: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref en el rango [0x000000000000660-0x0000000000000667] RIP: 0010:btrfs_update_reloc_root+0x362/0xa80 fs/btrfs/relocation.c:926 Seguimiento de llamadas:  commit_fs_roots+0x2ee/0x720 fs/btrfs/transaction.c:1496 btrfs_commit_transaction+0xfaf/0x3740 fs/btrfs/transaction.c:2430 del_balance_item fs/btrfs/volumes.c:3678 [en l\u00ednea] reset_balance_state+0x25e/0x3c0 fs/btrfs/volumes.c:3742 btrfs_balance+0xead/0x10c0 fs/btrfs/volumes.c:4574 btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f [CAUSA] El fallo de asignaci\u00f3n ocurre en start_transaction() dentro de prepare_to_relocate(), y durante el manejo de errores llamamos a unset_reloc_control(), lo que hace que fs_info-\u0026gt;balance_ctl sea NULL. Luego continuamos con la limpieza de la ruta de error en btrfs_balance() llamando a reset_balance_state() que llamar\u00e1 a del_balance_item() para eliminar por completo el elemento de balance en el \u00e1rbol ra\u00edz. Sin embargo, durante la peque\u00f1a ventana entre set_reloc_contrl() y unset_reloc_control(), podemos tener una actualizaci\u00f3n del \u00e1rbol de subvolumen y crear un reloc_root para ese subvolumen. Luego pasamos a la btrfs_commit_transaction() final de del_balance_item() y a btrfs_update_reloc_root() dentro de commit_fs_roots(). Esa funci\u00f3n verifica si fs_info-\u0026gt;reloc_ctl est\u00e1 en la etapa merge_reloc_tree, pero dado que fs_info-\u0026gt;reloc_ctl es NULL, da como resultado una desreferencia de puntero NULL. [SOLUCI\u00d3N] Solo hay que a\u00f1adir una comprobaci\u00f3n adicional en fs_info-\u0026gt;reloc_ctl dentro de btrfs_update_reloc_root(), antes de comprobar fs_info-\u0026gt;reloc_ctl-\u0026gt;merge_reloc_tree. El manejo de DEAD_RELOC_TREE sirve para evitar modificaciones adicionales del \u00e1rbol de reubicaci\u00f3n durante la etapa de fusi\u00f3n, pero como no hay ning\u00fan reloc_ctl, no tenemos que preocuparnos por eso.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/btrfs/relocation.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3fd0a5585eb98e074fb9934549c8d85c49756c0d\",\"lessThan\":\"1282f001cbf56e5dd6e90a18e205a566793f4be0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3fd0a5585eb98e074fb9934549c8d85c49756c0d\",\"lessThan\":\"d73d48acf36f57362df7e4f9d76568168bf5e944\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3fd0a5585eb98e074fb9934549c8d85c49756c0d\",\"lessThan\":\"37fee9c220b92c3b7bf22b51c51dde5364e7590b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3fd0a5585eb98e074fb9934549c8d85c49756c0d\",\"lessThan\":\"d13249c0df7aab885acb149695f82c54c0822a70\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3fd0a5585eb98e074fb9934549c8d85c49756c0d\",\"lessThan\":\"7ad0c5868f2f0418619089513d95230c66cb7eb4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3fd0a5585eb98e074fb9934549c8d85c49756c0d\",\"lessThan\":\"dc02c1440705e3451abd1c2c8114a5c1bb188e9f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3fd0a5585eb98e074fb9934549c8d85c49756c0d\",\"lessThan\":\"39356ec0e319ed07627b3a0f402d0608546509e6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3fd0a5585eb98e074fb9934549c8d85c49756c0d\",\"lessThan\":\"c3b47f49e83197e8dffd023ec568403bcdbb774b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/btrfs/relocation.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.35\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.35\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.285\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.227\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.168\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.113\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.55\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.14\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.3\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-22T13:47:20.255256Z\",\"id\":\"CVE-2024-49868\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.10.227\",\"matchCriteriaId\":\"EB525A44-6338-4857-AD90-EA2860D1AD1F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.168\",\"matchCriteriaId\":\"4D51C05D-455B-4D8D-89E7-A58E140B864C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.113\",\"matchCriteriaId\":\"D01BD22E-ACD1-4618-9D01-6116570BE1EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.55\",\"matchCriteriaId\":\"E90B9576-56C4-47BC-AAB0-C5B2D438F5D0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.14\",\"matchCriteriaId\":\"4C16BCE0-FFA0-4599-BE0A-1FD65101C021\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.11\",\"versionEndExcluding\":\"6.11.3\",\"matchCriteriaId\":\"54D9C704-D679-41A7-9C40-10A6B1E7FFE9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1282f001cbf56e5dd6e90a18e205a566793f4be0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/37fee9c220b92c3b7bf22b51c51dde5364e7590b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/39356ec0e319ed07627b3a0f402d0608546509e6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7ad0c5868f2f0418619089513d95230c66cb7eb4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c3b47f49e83197e8dffd023ec568403bcdbb774b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d13249c0df7aab885acb149695f82c54c0822a70\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d73d48acf36f57362df7e4f9d76568168bf5e944\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dc02c1440705e3451abd1c2c8114a5c1bb188e9f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T14:21:32+00:00",
      "cve": "CVE-2024-49868",
      "id": "CVE-2024-49868",
      "initial_release_date": "2024-10-21T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-49868.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:12:46Z",
      "cve": "CVE-2024-49868",
      "id": "CVE-2024-49868",
      "initial_release_date": "2024-10-25T03:07:33Z",
      "product_status:known_affected": "655",
      "product_status:known_not_affected": "32",
      "product_status:recommended": "595",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-49868",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-49868.json",
      "version": "61"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:22:35.952Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-49868\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-22T13:47:20.255256Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-22T13:47:23.940Z\"}}], \"cna\": {\"title\": \"btrfs: fix a NULL pointer dereference when failed to start a new trasacntion\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3fd0a5585eb98e074fb9934549c8d85c49756c0d\", \"lessThan\": \"1282f001cbf56e5dd6e90a18e205a566793f4be0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3fd0a5585eb98e074fb9934549c8d85c49756c0d\", \"lessThan\": \"d73d48acf36f57362df7e4f9d76568168bf5e944\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3fd0a5585eb98e074fb9934549c8d85c49756c0d\", \"lessThan\": \"37fee9c220b92c3b7bf22b51c51dde5364e7590b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3fd0a5585eb98e074fb9934549c8d85c49756c0d\", \"lessThan\": \"d13249c0df7aab885acb149695f82c54c0822a70\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3fd0a5585eb98e074fb9934549c8d85c49756c0d\", \"lessThan\": \"7ad0c5868f2f0418619089513d95230c66cb7eb4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3fd0a5585eb98e074fb9934549c8d85c49756c0d\", \"lessThan\": \"dc02c1440705e3451abd1c2c8114a5c1bb188e9f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3fd0a5585eb98e074fb9934549c8d85c49756c0d\", \"lessThan\": \"39356ec0e319ed07627b3a0f402d0608546509e6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3fd0a5585eb98e074fb9934549c8d85c49756c0d\", \"lessThan\": \"c3b47f49e83197e8dffd023ec568403bcdbb774b\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/btrfs/relocation.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.35\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.35\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.285\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.227\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.168\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.113\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.55\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/btrfs/relocation.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/1282f001cbf56e5dd6e90a18e205a566793f4be0\"}, {\"url\": \"https://git.kernel.org/stable/c/d73d48acf36f57362df7e4f9d76568168bf5e944\"}, {\"url\": \"https://git.kernel.org/stable/c/37fee9c220b92c3b7bf22b51c51dde5364e7590b\"}, {\"url\": \"https://git.kernel.org/stable/c/d13249c0df7aab885acb149695f82c54c0822a70\"}, {\"url\": \"https://git.kernel.org/stable/c/7ad0c5868f2f0418619089513d95230c66cb7eb4\"}, {\"url\": \"https://git.kernel.org/stable/c/dc02c1440705e3451abd1c2c8114a5c1bb188e9f\"}, {\"url\": \"https://git.kernel.org/stable/c/39356ec0e319ed07627b3a0f402d0608546509e6\"}, {\"url\": \"https://git.kernel.org/stable/c/c3b47f49e83197e8dffd023ec568403bcdbb774b\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix a NULL pointer dereference when failed to start a new trasacntion\\n\\n[BUG]\\nSyzbot reported a NULL pointer dereference with the following crash:\\n\\n  FAULT_INJECTION: forcing a failure.\\n   start_transaction+0x830/0x1670 fs/btrfs/transaction.c:676\\n   prepare_to_relocate+0x31f/0x4c0 fs/btrfs/relocation.c:3642\\n   relocate_block_group+0x169/0xd20 fs/btrfs/relocation.c:3678\\n  ...\\n  BTRFS info (device loop0): balance: ended with status: -12\\n  Oops: general protection fault, probably for non-canonical address 0xdffffc00000000cc: 0000 [#1] PREEMPT SMP KASAN NOPTI\\n  KASAN: null-ptr-deref in range [0x0000000000000660-0x0000000000000667]\\n  RIP: 0010:btrfs_update_reloc_root+0x362/0xa80 fs/btrfs/relocation.c:926\\n  Call Trace:\\n   \u003cTASK\u003e\\n   commit_fs_roots+0x2ee/0x720 fs/btrfs/transaction.c:1496\\n   btrfs_commit_transaction+0xfaf/0x3740 fs/btrfs/transaction.c:2430\\n   del_balance_item fs/btrfs/volumes.c:3678 [inline]\\n   reset_balance_state+0x25e/0x3c0 fs/btrfs/volumes.c:3742\\n   btrfs_balance+0xead/0x10c0 fs/btrfs/volumes.c:4574\\n   btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673\\n   vfs_ioctl fs/ioctl.c:51 [inline]\\n   __do_sys_ioctl fs/ioctl.c:907 [inline]\\n   __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893\\n   do_syscall_x64 arch/x86/entry/common.c:52 [inline]\\n   do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83\\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n\\n[CAUSE]\\nThe allocation failure happens at the start_transaction() inside\\nprepare_to_relocate(), and during the error handling we call\\nunset_reloc_control(), which makes fs_info-\u003ebalance_ctl to be NULL.\\n\\nThen we continue the error path cleanup in btrfs_balance() by calling\\nreset_balance_state() which will call del_balance_item() to fully delete\\nthe balance item in the root tree.\\n\\nHowever during the small window between set_reloc_contrl() and\\nunset_reloc_control(), we can have a subvolume tree update and created a\\nreloc_root for that subvolume.\\n\\nThen we go into the final btrfs_commit_transaction() of\\ndel_balance_item(), and into btrfs_update_reloc_root() inside\\ncommit_fs_roots().\\n\\nThat function checks if fs_info-\u003ereloc_ctl is in the merge_reloc_tree\\nstage, but since fs_info-\u003ereloc_ctl is NULL, it results a NULL pointer\\ndereference.\\n\\n[FIX]\\nJust add extra check on fs_info-\u003ereloc_ctl inside\\nbtrfs_update_reloc_root(), before checking\\nfs_info-\u003ereloc_ctl-\u003emerge_reloc_tree.\\n\\nThat DEAD_RELOC_TREE handling is to prevent further modification to the\\nreloc tree during merge stage, but since there is no reloc_ctl at all,\\nwe do not need to bother that.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.285\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.227\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.168\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.113\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.55\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.14\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.3\", \"versionStartIncluding\": \"2.6.35\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"2.6.35\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-01-05T10:54:10.554Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-49868\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-05T10:54:10.554Z\", \"dateReserved\": \"2024-10-21T12:17:06.019Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-10-21T18:01:10.722Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.