GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-50225 (GCVE-0-2024-50225)

Vulnerability from cvelistv5 – Published: 2024-11-09 10:14 – Updated: 2026-08-05 11:42
VLAI
Title
btrfs: fix error propagation of split bios
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix error propagation of split bios The purpose of btrfs_bbio_propagate_error() shall be propagating an error of split bio to its original btrfs_bio, and tell the error to the upper layer. However, it's not working well on some cases. * Case 1. Immediate (or quick) end_bio with an error When btrfs sends btrfs_bio to mirrored devices, btrfs calls btrfs_bio_end_io() when all the mirroring bios are completed. If that btrfs_bio was split, it is from btrfs_clone_bioset and its end_io function is btrfs_orig_write_end_io. For this case, btrfs_bbio_propagate_error() accesses the orig_bbio's bio context to increase the error count. That works well in most cases. However, if the end_io is called enough fast, orig_bbio's (remaining part after split) bio context may not be properly set at that time. Since the bio context is set when the orig_bbio (the last btrfs_bio) is sent to devices, that might be too late for earlier split btrfs_bio's completion. That will result in NULL pointer dereference. That bug is easily reproducible by running btrfs/146 on zoned devices [1] and it shows the following trace. [1] You need raid-stripe-tree feature as it create "-d raid0 -m raid1" FS. BUG: kernel NULL pointer dereference, address: 0000000000000020 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 UID: 0 PID: 13 Comm: kworker/u32:1 Not tainted 6.11.0-rc7-BTRFS-ZNS+ #474 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Workqueue: writeback wb_workfn (flush-btrfs-5) RIP: 0010:btrfs_bio_end_io+0xae/0xc0 [btrfs] BTRFS error (device dm-0): bdev /dev/mapper/error-test errs: wr 2, rd 0, flush 0, corrupt 0, gen 0 RSP: 0018:ffffc9000006f248 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888005a7f080 RCX: ffffc9000006f1dc RDX: 0000000000000000 RSI: 000000000000000a RDI: ffff888005a7f080 RBP: ffff888011dfc540 R08: 0000000000000000 R09: 0000000000000001 R10: ffffffff82e508e0 R11: 0000000000000005 R12: ffff88800ddfbe58 R13: ffff888005a7f080 R14: ffff888005a7f158 R15: ffff888005a7f158 FS: 0000000000000000(0000) GS:ffff88803ea80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000020 CR3: 0000000002e22006 CR4: 0000000000370ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? __die_body.cold+0x19/0x26 ? page_fault_oops+0x13e/0x2b0 ? _printk+0x58/0x73 ? do_user_addr_fault+0x5f/0x750 ? exc_page_fault+0x76/0x240 ? asm_exc_page_fault+0x22/0x30 ? btrfs_bio_end_io+0xae/0xc0 [btrfs] ? btrfs_log_dev_io_error+0x7f/0x90 [btrfs] btrfs_orig_write_end_io+0x51/0x90 [btrfs] dm_submit_bio+0x5c2/0xa50 [dm_mod] ? find_held_lock+0x2b/0x80 ? blk_try_enter_queue+0x90/0x1e0 __submit_bio+0xe0/0x130 ? ktime_get+0x10a/0x160 ? lockdep_hardirqs_on+0x74/0x100 submit_bio_noacct_nocheck+0x199/0x410 btrfs_submit_bio+0x7d/0x150 [btrfs] btrfs_submit_chunk+0x1a1/0x6d0 [btrfs] ? lockdep_hardirqs_on+0x74/0x100 ? __folio_start_writeback+0x10/0x2c0 btrfs_submit_bbio+0x1c/0x40 [btrfs] submit_one_bio+0x44/0x60 [btrfs] submit_extent_folio+0x13f/0x330 [btrfs] ? btrfs_set_range_writeback+0xa3/0xd0 [btrfs] extent_writepage_io+0x18b/0x360 [btrfs] extent_write_locked_range+0x17c/0x340 [btrfs] ? __pfx_end_bbio_data_write+0x10/0x10 [btrfs] run_delalloc_cow+0x71/0xd0 [btrfs] btrfs_run_delalloc_range+0x176/0x500 [btrfs] ? find_lock_delalloc_range+0x119/0x260 [btrfs] writepage_delalloc+0x2ab/0x480 [btrfs] extent_write_cache_pages+0x236/0x7d0 [btrfs] btrfs_writepages+0x72/0x130 [btrfs] do_writepages+0xd4/0x240 ? find_held_lock+0x2b/0x80 ? wbc_attach_and_unlock_inode+0x12c/0x290 ? wbc_attach_and_unlock_inode+0x12c/0x29 ---truncated---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 20:16 UTC
CWE
  • CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 852eee62d31abd695cd43e1b875d664ed292a8ca , < 22833d89b780ba0f9f66e19c477e7decf638edce (git)
Affected: 852eee62d31abd695cd43e1b875d664ed292a8ca , < d48e1dea3931de64c26717adc2b89743c7ab6594 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.11.7 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50225",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:16:54.858322Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:17:28.196Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/bio.c",
            "fs/btrfs/bio.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "22833d89b780ba0f9f66e19c477e7decf638edce",
              "status": "affected",
              "version": "852eee62d31abd695cd43e1b875d664ed292a8ca",
              "versionType": "git"
            },
            {
              "lessThan": "d48e1dea3931de64c26717adc2b89743c7ab6594",
              "status": "affected",
              "version": "852eee62d31abd695cd43e1b875d664ed292a8ca",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/bio.c",
            "fs/btrfs/bio.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.7",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix error propagation of split bios\n\nThe purpose of btrfs_bbio_propagate_error() shall be propagating an error\nof split bio to its original btrfs_bio, and tell the error to the upper\nlayer. However, it\u0027s not working well on some cases.\n\n* Case 1. Immediate (or quick) end_bio with an error\n\nWhen btrfs sends btrfs_bio to mirrored devices, btrfs calls\nbtrfs_bio_end_io() when all the mirroring bios are completed. If that\nbtrfs_bio was split, it is from btrfs_clone_bioset and its end_io function\nis btrfs_orig_write_end_io. For this case, btrfs_bbio_propagate_error()\naccesses the orig_bbio\u0027s bio context to increase the error count.\n\nThat works well in most cases. However, if the end_io is called enough\nfast, orig_bbio\u0027s (remaining part after split) bio context may not be\nproperly set at that time. Since the bio context is set when the orig_bbio\n(the last btrfs_bio) is sent to devices, that might be too late for earlier\nsplit btrfs_bio\u0027s completion.  That will result in NULL pointer\ndereference.\n\nThat bug is easily reproducible by running btrfs/146 on zoned devices [1]\nand it shows the following trace.\n\n[1] You need raid-stripe-tree feature as it create \"-d raid0 -m raid1\" FS.\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000020\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 0 P4D 0\n  Oops: Oops: 0000 [#1] PREEMPT SMP PTI\n  CPU: 1 UID: 0 PID: 13 Comm: kworker/u32:1 Not tainted 6.11.0-rc7-BTRFS-ZNS+ #474\n  Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n  Workqueue: writeback wb_workfn (flush-btrfs-5)\n  RIP: 0010:btrfs_bio_end_io+0xae/0xc0 [btrfs]\n  BTRFS error (device dm-0): bdev /dev/mapper/error-test errs: wr 2, rd 0, flush 0, corrupt 0, gen 0\n  RSP: 0018:ffffc9000006f248 EFLAGS: 00010246\n  RAX: 0000000000000000 RBX: ffff888005a7f080 RCX: ffffc9000006f1dc\n  RDX: 0000000000000000 RSI: 000000000000000a RDI: ffff888005a7f080\n  RBP: ffff888011dfc540 R08: 0000000000000000 R09: 0000000000000001\n  R10: ffffffff82e508e0 R11: 0000000000000005 R12: ffff88800ddfbe58\n  R13: ffff888005a7f080 R14: ffff888005a7f158 R15: ffff888005a7f158\n  FS:  0000000000000000(0000) GS:ffff88803ea80000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 0000000000000020 CR3: 0000000002e22006 CR4: 0000000000370ef0\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  Call Trace:\n   \u003cTASK\u003e\n   ? __die_body.cold+0x19/0x26\n   ? page_fault_oops+0x13e/0x2b0\n   ? _printk+0x58/0x73\n   ? do_user_addr_fault+0x5f/0x750\n   ? exc_page_fault+0x76/0x240\n   ? asm_exc_page_fault+0x22/0x30\n   ? btrfs_bio_end_io+0xae/0xc0 [btrfs]\n   ? btrfs_log_dev_io_error+0x7f/0x90 [btrfs]\n   btrfs_orig_write_end_io+0x51/0x90 [btrfs]\n   dm_submit_bio+0x5c2/0xa50 [dm_mod]\n   ? find_held_lock+0x2b/0x80\n   ? blk_try_enter_queue+0x90/0x1e0\n   __submit_bio+0xe0/0x130\n   ? ktime_get+0x10a/0x160\n   ? lockdep_hardirqs_on+0x74/0x100\n   submit_bio_noacct_nocheck+0x199/0x410\n   btrfs_submit_bio+0x7d/0x150 [btrfs]\n   btrfs_submit_chunk+0x1a1/0x6d0 [btrfs]\n   ? lockdep_hardirqs_on+0x74/0x100\n   ? __folio_start_writeback+0x10/0x2c0\n   btrfs_submit_bbio+0x1c/0x40 [btrfs]\n   submit_one_bio+0x44/0x60 [btrfs]\n   submit_extent_folio+0x13f/0x330 [btrfs]\n   ? btrfs_set_range_writeback+0xa3/0xd0 [btrfs]\n   extent_writepage_io+0x18b/0x360 [btrfs]\n   extent_write_locked_range+0x17c/0x340 [btrfs]\n   ? __pfx_end_bbio_data_write+0x10/0x10 [btrfs]\n   run_delalloc_cow+0x71/0xd0 [btrfs]\n   btrfs_run_delalloc_range+0x176/0x500 [btrfs]\n   ? find_lock_delalloc_range+0x119/0x260 [btrfs]\n   writepage_delalloc+0x2ab/0x480 [btrfs]\n   extent_write_cache_pages+0x236/0x7d0 [btrfs]\n   btrfs_writepages+0x72/0x130 [btrfs]\n   do_writepages+0xd4/0x240\n   ? find_held_lock+0x2b/0x80\n   ? wbc_attach_and_unlock_inode+0x12c/0x290\n   ? wbc_attach_and_unlock_inode+0x12c/0x29\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is the btrfs bio submission/completion path reached through ordinary local file writes and writeback on a mounted btrfs filesystem (btrfs_writepages \u2192 btrfs_submit_bbio \u2192 btrfs_bio_end_io); there is no network-facing entry point.\nAC:L - On a degraded or removable multi-device btrfs, btrfs_submit_dev_bio() takes the synchronous bio_io_error() path, so the split bio completes with an error before the original bbio is ever submitted \u2014 a deterministic NULL bi_private dereference, not a race; where a race is involved (zoned/RST, Case 2 early completion) the attacker controls the write volume and pattern that drive both sides, and the upstream reproducer (btrfs/146) hits it easily.\nPR:L - Any unprivileged local user with write access to a btrfs filesystem generates the delalloc/writeback bios that get split; no capability, ioctl privilege, or admin check exists anywhere along the path from write(2) to btrfs_bbio_propagate_error().\nUI:N - The faulting code runs asynchronously in a writeback kworker after the attacker\u0027s writes; no victim action, mount, or file open by another user is required.\nS:U - The corruption and crash are confined to the kernel\u0027s own memory and the filesystem it manages, with no crossing of a VM, IOMMU, or other security-authority boundary.\nC:H - Beyond the NULL dereference, an early-completing original bbio causes btrfs_put_bioc() to free the btrfs_io_context while a split bio is still in flight, so orig_stripe-\u003ebioc is read out of freed (potentially reallocated and heap-groomed) slab memory \u2014 memory corruption leverageable for kernel information disclosure.\nI:H - The stale-pointer path performs atomic_add(orig_bioc-\u003emax_errors, \u0026orig_bioc-\u003eerror) through a pointer read from freed memory, yielding a write primitive at an attacker-influenceable kernel address; independently, the broken propagation silently reports failed data and metadata writes as BLK_STS_OK, so writeback and fsync succeed for data never persisted.\nA:H - The confirmed failure mode is a kernel NULL pointer dereference oops at address 0x20 inside a writeback kworker (killing the thread while holding writeback/ordered-extent state, wedging the filesystem), and the use-after-free variant likewise leads to panics."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:42:37.937Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/22833d89b780ba0f9f66e19c477e7decf638edce"
        },
        {
          "url": "https://git.kernel.org/stable/c/d48e1dea3931de64c26717adc2b89743c7ab6594"
        }
      ],
      "title": "btrfs: fix error propagation of split bios",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50225",
    "datePublished": "2024-11-09T10:14:36.065Z",
    "dateReserved": "2024-10-21T19:36:19.973Z",
    "dateUpdated": "2026-08-05T11:42:37.937Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50225",
      "date": "2026-09-16",
      "epss": "0.00214",
      "percentile": "0.11895"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.3\", \"versionEndExcluding\": \"6.11.7\", \"matchCriteriaId\": \"5972B133-90E2-44DE-AE0B-A0939F0D914F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F361E1D-580F-4A2D-A509-7615F73167A1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0F717D8-3014-4F84-8086-0124B2111379\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"24DBE6C7-2AAE-4818-AED2-E131F153D2FA\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix error propagation of split bios\\n\\nThe purpose of btrfs_bbio_propagate_error() shall be propagating an error\\nof split bio to its original btrfs_bio, and tell the error to the upper\\nlayer. However, it\u0027s not working well on some cases.\\n\\n* Case 1. Immediate (or quick) end_bio with an error\\n\\nWhen btrfs sends btrfs_bio to mirrored devices, btrfs calls\\nbtrfs_bio_end_io() when all the mirroring bios are completed. If that\\nbtrfs_bio was split, it is from btrfs_clone_bioset and its end_io function\\nis btrfs_orig_write_end_io. For this case, btrfs_bbio_propagate_error()\\naccesses the orig_bbio\u0027s bio context to increase the error count.\\n\\nThat works well in most cases. However, if the end_io is called enough\\nfast, orig_bbio\u0027s (remaining part after split) bio context may not be\\nproperly set at that time. Since the bio context is set when the orig_bbio\\n(the last btrfs_bio) is sent to devices, that might be too late for earlier\\nsplit btrfs_bio\u0027s completion.  That will result in NULL pointer\\ndereference.\\n\\nThat bug is easily reproducible by running btrfs/146 on zoned devices [1]\\nand it shows the following trace.\\n\\n[1] You need raid-stripe-tree feature as it create \\\"-d raid0 -m raid1\\\" FS.\\n\\n  BUG: kernel NULL pointer dereference, address: 0000000000000020\\n  #PF: supervisor read access in kernel mode\\n  #PF: error_code(0x0000) - not-present page\\n  PGD 0 P4D 0\\n  Oops: Oops: 0000 [#1] PREEMPT SMP PTI\\n  CPU: 1 UID: 0 PID: 13 Comm: kworker/u32:1 Not tainted 6.11.0-rc7-BTRFS-ZNS+ #474\\n  Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\\n  Workqueue: writeback wb_workfn (flush-btrfs-5)\\n  RIP: 0010:btrfs_bio_end_io+0xae/0xc0 [btrfs]\\n  BTRFS error (device dm-0): bdev /dev/mapper/error-test errs: wr 2, rd 0, flush 0, corrupt 0, gen 0\\n  RSP: 0018:ffffc9000006f248 EFLAGS: 00010246\\n  RAX: 0000000000000000 RBX: ffff888005a7f080 RCX: ffffc9000006f1dc\\n  RDX: 0000000000000000 RSI: 000000000000000a RDI: ffff888005a7f080\\n  RBP: ffff888011dfc540 R08: 0000000000000000 R09: 0000000000000001\\n  R10: ffffffff82e508e0 R11: 0000000000000005 R12: ffff88800ddfbe58\\n  R13: ffff888005a7f080 R14: ffff888005a7f158 R15: ffff888005a7f158\\n  FS:  0000000000000000(0000) GS:ffff88803ea80000(0000) knlGS:0000000000000000\\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n  CR2: 0000000000000020 CR3: 0000000002e22006 CR4: 0000000000370ef0\\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n  Call Trace:\\n   \u003cTASK\u003e\\n   ? __die_body.cold+0x19/0x26\\n   ? page_fault_oops+0x13e/0x2b0\\n   ? _printk+0x58/0x73\\n   ? do_user_addr_fault+0x5f/0x750\\n   ? exc_page_fault+0x76/0x240\\n   ? asm_exc_page_fault+0x22/0x30\\n   ? btrfs_bio_end_io+0xae/0xc0 [btrfs]\\n   ? btrfs_log_dev_io_error+0x7f/0x90 [btrfs]\\n   btrfs_orig_write_end_io+0x51/0x90 [btrfs]\\n   dm_submit_bio+0x5c2/0xa50 [dm_mod]\\n   ? find_held_lock+0x2b/0x80\\n   ? blk_try_enter_queue+0x90/0x1e0\\n   __submit_bio+0xe0/0x130\\n   ? ktime_get+0x10a/0x160\\n   ? lockdep_hardirqs_on+0x74/0x100\\n   submit_bio_noacct_nocheck+0x199/0x410\\n   btrfs_submit_bio+0x7d/0x150 [btrfs]\\n   btrfs_submit_chunk+0x1a1/0x6d0 [btrfs]\\n   ? lockdep_hardirqs_on+0x74/0x100\\n   ? __folio_start_writeback+0x10/0x2c0\\n   btrfs_submit_bbio+0x1c/0x40 [btrfs]\\n   submit_one_bio+0x44/0x60 [btrfs]\\n   submit_extent_folio+0x13f/0x330 [btrfs]\\n   ? btrfs_set_range_writeback+0xa3/0xd0 [btrfs]\\n   extent_writepage_io+0x18b/0x360 [btrfs]\\n   extent_write_locked_range+0x17c/0x340 [btrfs]\\n   ? __pfx_end_bbio_data_write+0x10/0x10 [btrfs]\\n   run_delalloc_cow+0x71/0xd0 [btrfs]\\n   btrfs_run_delalloc_range+0x176/0x500 [btrfs]\\n   ? find_lock_delalloc_range+0x119/0x260 [btrfs]\\n   writepage_delalloc+0x2ab/0x480 [btrfs]\\n   extent_write_cache_pages+0x236/0x7d0 [btrfs]\\n   btrfs_writepages+0x72/0x130 [btrfs]\\n   do_writepages+0xd4/0x240\\n   ? find_held_lock+0x2b/0x80\\n   ? wbc_attach_and_unlock_inode+0x12c/0x290\\n   ? wbc_attach_and_unlock_inode+0x12c/0x29\\n---truncated---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: corregir la propagaci\\u00f3n de errores de bios divididas El prop\\u00f3sito de btrfs_bbio_propagate_error() debe ser propagar un error de bio dividida a su btrfs_bio original y comunicar el error a la capa superior. Sin embargo, no est\\u00e1 funcionando bien en algunos casos. * Caso 1. End_bio inmediato (o r\\u00e1pido) con un error Cuando btrfs env\\u00eda btrfs_bio a dispositivos reflejados, btrfs llama a btrfs_bio_end_io() cuando se completan todos los bios reflejados. Si ese btrfs_bio se dividi\\u00f3, es de btrfs_clone_bioset y su funci\\u00f3n end_io es btrfs_orig_write_end_io. Para este caso, btrfs_bbio_propagate_error() accede al contexto bio de orig_bbio para aumentar el recuento de errores. Eso funciona bien en la mayor\\u00eda de los casos. Sin embargo, si se llama a end_io lo suficientemente r\\u00e1pido, es posible que el contexto bio de orig_bbio (la parte restante despu\\u00e9s de la divisi\\u00f3n) no se configure correctamente en ese momento. Dado que el contexto bio se configura cuando se env\\u00eda orig_bbio (el \\u00faltimo btrfs_bio) a los dispositivos, puede que sea demasiado tarde para que se complete la divisi\\u00f3n anterior de btrfs_bio. Eso dar\\u00e1 como resultado la desreferencia del puntero NULL. Ese error se puede reproducir f\\u00e1cilmente ejecutando btrfs/146 en dispositivos zonificados [1] y muestra el siguiente rastro. [1] Necesita la funci\\u00f3n raid-stripe-tree, ya que crea el sistema de archivos \\\"-d raid0 -m raid1\\\". ERROR: desreferencia de puntero NULL del kernel, direcci\\u00f3n: 0000000000000020 #PF: acceso de lectura del supervisor en modo kernel #PF: error_code(0x0000) - p\\u00e1gina no presente PGD 0 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 UID: 0 PID: 13 Comm: kworker/u32:1 No contaminado 6.11.0-rc7-BTRFS-ZNS+ #474 Nombre del hardware: Bochs Bochs, BIOS Bochs 01/01/2011 Cola de trabajo: escritura diferida wb_workfn (flush-btrfs-5) RIP: 0010:btrfs_bio_end_io+0xae/0xc0 [btrfs] Error BTRFS (dispositivo dm-0): bdev /dev/mapper/error-test errores: wr 2, rd 0, vaciado 0, corrupto 0, generaci\\u00f3n 0 RSP: 0018:ffffc9000006f248 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888005a7f080 RCX: ffffc9000006f1dc RDX: 0000000000000000 RSI: 000000000000000a RDI: ffff888005a7f080 RBP: ffff888011dfc540 R08: 0000000000000000 R09: 0000000000000001 R10: ffffffff82e508e0 R11: 0000000000000005 R12: ffff88800ddfbe58 R13: ffff888005a7f080 R14: ffff888005a7f158 R15: ffff888005a7f158 FS: 000000000000000(0000) GS:ffff88803ea80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000020 CR3: 0000000002e22006 CR4: 0000000000370ef0 DR0: 00000000000000000 DR1: 00000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Seguimiento de llamadas:  ? __die_body.cold+0x19/0x26 ? page_fault_oops+0x13e/0x2b0 ? _printk+0x58/0x73 ? do_user_addr_fault+0x5f/0x750 ? btrfs_log_dev_io_error+0x7f/0x90 [btrfs] btrfs_orig_write_end_io+0x51/0x90 [btrfs] dm_submit_bio+0x5c2/0xa50 [dm_mod] ? blk_try_enter_queue+0x90/0x1e0 __submit_bio+0xe0/0x130 ? ktime_get+0x10a/0x160 ? lockdep_hardirqs_on+0x74/0x100 submit_bio_noacct_nocheck+0x199/0x410 btrfs_submit_bio+0x7d/0x150 [btrfs] btrfs_submit_chunk+0x1a1/0x6d0 [btrfs]? lockdep_hardirqs_on+0x74/0x100? __folio_start_writeback+0x10/0x2c0 btrfs_submit_bbio+0x1c/0x40 [btrfs] submit_one_bio+0x44/0x60 [btrfs] submit_extent_folio+0x13f/0x330 [btrfs] ? btrfs_set_range_writeback+0xa3/0xd0 [btrfs] extend_writepage_io+0x18b/0x360 [btrfs] extend_write_locked_range+0x17c/0x340 [btrfs] ? __pfx_end_bbio_data_write+0x10/0x10 [btrfs] run_delalloc_cow+0x71/0xd0 [btrfs] btrfs_run_delalloc_range+0x176/0x500 [btrfs] ? buscar_bloqueo_desbloqueado_rango+0x119/0x260 [btrfs] escribir_p\\u00e1gina_desbloqueado+0x2ab/0x480 [btrfs] extensi\\u00f3n_escritura_p\\u00e1ginas_cach\\u00e9+0x236/0x7d0 [btrfs] btrfs_escritura_p\\u00e1ginas+0x72/0x130 [btrfs] hacer_escritura_p\\u00e1ginas+0xd4/0x240 ? buscar_bloqueo_retenido+0x2b/0x80 ? wbc_adjuntar_y_desbloquear_inodo+0x12c/0x290 ? wbc_adjuntar_y_desbloquear_inodo+0x12c/0x29 ---truncado---\"}]",
      "id": "CVE-2024-50225",
      "lastModified": "2024-11-13T19:21:44.323",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-11-09T11:15:07.990",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/22833d89b780ba0f9f66e19c477e7decf638edce\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d48e1dea3931de64c26717adc2b89743c7ab6594\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-06-28T01:56:21.000Z",
      "cve": "CVE-2024-50225",
      "id": "msrc_CVE-2024-50225",
      "initial_release_date": "2024-11-02T00:00:00.000Z",
      "product_status:under_investigation": "16",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "btrfs: fix error propagation of split bios",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-50225.json",
      "version": "13"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-50225\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-09T11:15:07.990\",\"lastModified\":\"2026-08-04T11:21:34.790\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix error propagation of split bios\\n\\nThe purpose of btrfs_bbio_propagate_error() shall be propagating an error\\nof split bio to its original btrfs_bio, and tell the error to the upper\\nlayer. However, it\u0027s not working well on some cases.\\n\\n* Case 1. Immediate (or quick) end_bio with an error\\n\\nWhen btrfs sends btrfs_bio to mirrored devices, btrfs calls\\nbtrfs_bio_end_io() when all the mirroring bios are completed. If that\\nbtrfs_bio was split, it is from btrfs_clone_bioset and its end_io function\\nis btrfs_orig_write_end_io. For this case, btrfs_bbio_propagate_error()\\naccesses the orig_bbio\u0027s bio context to increase the error count.\\n\\nThat works well in most cases. However, if the end_io is called enough\\nfast, orig_bbio\u0027s (remaining part after split) bio context may not be\\nproperly set at that time. Since the bio context is set when the orig_bbio\\n(the last btrfs_bio) is sent to devices, that might be too late for earlier\\nsplit btrfs_bio\u0027s completion.  That will result in NULL pointer\\ndereference.\\n\\nThat bug is easily reproducible by running btrfs/146 on zoned devices [1]\\nand it shows the following trace.\\n\\n[1] You need raid-stripe-tree feature as it create \\\"-d raid0 -m raid1\\\" FS.\\n\\n  BUG: kernel NULL pointer dereference, address: 0000000000000020\\n  #PF: supervisor read access in kernel mode\\n  #PF: error_code(0x0000) - not-present page\\n  PGD 0 P4D 0\\n  Oops: Oops: 0000 [#1] PREEMPT SMP PTI\\n  CPU: 1 UID: 0 PID: 13 Comm: kworker/u32:1 Not tainted 6.11.0-rc7-BTRFS-ZNS+ #474\\n  Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\\n  Workqueue: writeback wb_workfn (flush-btrfs-5)\\n  RIP: 0010:btrfs_bio_end_io+0xae/0xc0 [btrfs]\\n  BTRFS error (device dm-0): bdev /dev/mapper/error-test errs: wr 2, rd 0, flush 0, corrupt 0, gen 0\\n  RSP: 0018:ffffc9000006f248 EFLAGS: 00010246\\n  RAX: 0000000000000000 RBX: ffff888005a7f080 RCX: ffffc9000006f1dc\\n  RDX: 0000000000000000 RSI: 000000000000000a RDI: ffff888005a7f080\\n  RBP: ffff888011dfc540 R08: 0000000000000000 R09: 0000000000000001\\n  R10: ffffffff82e508e0 R11: 0000000000000005 R12: ffff88800ddfbe58\\n  R13: ffff888005a7f080 R14: ffff888005a7f158 R15: ffff888005a7f158\\n  FS:  0000000000000000(0000) GS:ffff88803ea80000(0000) knlGS:0000000000000000\\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n  CR2: 0000000000000020 CR3: 0000000002e22006 CR4: 0000000000370ef0\\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n  Call Trace:\\n   \u003cTASK\u003e\\n   ? __die_body.cold+0x19/0x26\\n   ? page_fault_oops+0x13e/0x2b0\\n   ? _printk+0x58/0x73\\n   ? do_user_addr_fault+0x5f/0x750\\n   ? exc_page_fault+0x76/0x240\\n   ? asm_exc_page_fault+0x22/0x30\\n   ? btrfs_bio_end_io+0xae/0xc0 [btrfs]\\n   ? btrfs_log_dev_io_error+0x7f/0x90 [btrfs]\\n   btrfs_orig_write_end_io+0x51/0x90 [btrfs]\\n   dm_submit_bio+0x5c2/0xa50 [dm_mod]\\n   ? find_held_lock+0x2b/0x80\\n   ? blk_try_enter_queue+0x90/0x1e0\\n   __submit_bio+0xe0/0x130\\n   ? ktime_get+0x10a/0x160\\n   ? lockdep_hardirqs_on+0x74/0x100\\n   submit_bio_noacct_nocheck+0x199/0x410\\n   btrfs_submit_bio+0x7d/0x150 [btrfs]\\n   btrfs_submit_chunk+0x1a1/0x6d0 [btrfs]\\n   ? lockdep_hardirqs_on+0x74/0x100\\n   ? __folio_start_writeback+0x10/0x2c0\\n   btrfs_submit_bbio+0x1c/0x40 [btrfs]\\n   submit_one_bio+0x44/0x60 [btrfs]\\n   submit_extent_folio+0x13f/0x330 [btrfs]\\n   ? btrfs_set_range_writeback+0xa3/0xd0 [btrfs]\\n   extent_writepage_io+0x18b/0x360 [btrfs]\\n   extent_write_locked_range+0x17c/0x340 [btrfs]\\n   ? __pfx_end_bbio_data_write+0x10/0x10 [btrfs]\\n   run_delalloc_cow+0x71/0xd0 [btrfs]\\n   btrfs_run_delalloc_range+0x176/0x500 [btrfs]\\n   ? find_lock_delalloc_range+0x119/0x260 [btrfs]\\n   writepage_delalloc+0x2ab/0x480 [btrfs]\\n   extent_write_cache_pages+0x236/0x7d0 [btrfs]\\n   btrfs_writepages+0x72/0x130 [btrfs]\\n   do_writepages+0xd4/0x240\\n   ? find_held_lock+0x2b/0x80\\n   ? wbc_attach_and_unlock_inode+0x12c/0x290\\n   ? wbc_attach_and_unlock_inode+0x12c/0x29\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: corregir la propagaci\u00f3n de errores de bios divididas El prop\u00f3sito de btrfs_bbio_propagate_error() debe ser propagar un error de bio dividida a su btrfs_bio original y comunicar el error a la capa superior. Sin embargo, no est\u00e1 funcionando bien en algunos casos. * Caso 1. End_bio inmediato (o r\u00e1pido) con un error Cuando btrfs env\u00eda btrfs_bio a dispositivos reflejados, btrfs llama a btrfs_bio_end_io() cuando se completan todos los bios reflejados. Si ese btrfs_bio se dividi\u00f3, es de btrfs_clone_bioset y su funci\u00f3n end_io es btrfs_orig_write_end_io. Para este caso, btrfs_bbio_propagate_error() accede al contexto bio de orig_bbio para aumentar el recuento de errores. Eso funciona bien en la mayor\u00eda de los casos. Sin embargo, si se llama a end_io lo suficientemente r\u00e1pido, es posible que el contexto bio de orig_bbio (la parte restante despu\u00e9s de la divisi\u00f3n) no se configure correctamente en ese momento. Dado que el contexto bio se configura cuando se env\u00eda orig_bbio (el \u00faltimo btrfs_bio) a los dispositivos, puede que sea demasiado tarde para que se complete la divisi\u00f3n anterior de btrfs_bio. Eso dar\u00e1 como resultado la desreferencia del puntero NULL. Ese error se puede reproducir f\u00e1cilmente ejecutando btrfs/146 en dispositivos zonificados [1] y muestra el siguiente rastro. [1] Necesita la funci\u00f3n raid-stripe-tree, ya que crea el sistema de archivos \\\"-d raid0 -m raid1\\\". ERROR: desreferencia de puntero NULL del kernel, direcci\u00f3n: 0000000000000020 #PF: acceso de lectura del supervisor en modo kernel #PF: error_code(0x0000) - p\u00e1gina no presente PGD 0 P4D 0 Oops: Oops: 0000 [#1] PREEMPT SMP PTI CPU: 1 UID: 0 PID: 13 Comm: kworker/u32:1 No contaminado 6.11.0-rc7-BTRFS-ZNS+ #474 Nombre del hardware: Bochs Bochs, BIOS Bochs 01/01/2011 Cola de trabajo: escritura diferida wb_workfn (flush-btrfs-5) RIP: 0010:btrfs_bio_end_io+0xae/0xc0 [btrfs] Error BTRFS (dispositivo dm-0): bdev /dev/mapper/error-test errores: wr 2, rd 0, vaciado 0, corrupto 0, generaci\u00f3n 0 RSP: 0018:ffffc9000006f248 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff888005a7f080 RCX: ffffc9000006f1dc RDX: 0000000000000000 RSI: 000000000000000a RDI: ffff888005a7f080 RBP: ffff888011dfc540 R08: 0000000000000000 R09: 0000000000000001 R10: ffffffff82e508e0 R11: 0000000000000005 R12: ffff88800ddfbe58 R13: ffff888005a7f080 R14: ffff888005a7f158 R15: ffff888005a7f158 FS: 000000000000000(0000) GS:ffff88803ea80000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000000020 CR3: 0000000002e22006 CR4: 0000000000370ef0 DR0: 00000000000000000 DR1: 00000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Seguimiento de llamadas:  ? __die_body.cold+0x19/0x26 ? page_fault_oops+0x13e/0x2b0 ? _printk+0x58/0x73 ? do_user_addr_fault+0x5f/0x750 ? btrfs_log_dev_io_error+0x7f/0x90 [btrfs] btrfs_orig_write_end_io+0x51/0x90 [btrfs] dm_submit_bio+0x5c2/0xa50 [dm_mod] ? blk_try_enter_queue+0x90/0x1e0 __submit_bio+0xe0/0x130 ? ktime_get+0x10a/0x160 ? lockdep_hardirqs_on+0x74/0x100 submit_bio_noacct_nocheck+0x199/0x410 btrfs_submit_bio+0x7d/0x150 [btrfs] btrfs_submit_chunk+0x1a1/0x6d0 [btrfs]? lockdep_hardirqs_on+0x74/0x100? __folio_start_writeback+0x10/0x2c0 btrfs_submit_bbio+0x1c/0x40 [btrfs] submit_one_bio+0x44/0x60 [btrfs] submit_extent_folio+0x13f/0x330 [btrfs] ? btrfs_set_range_writeback+0xa3/0xd0 [btrfs] extend_writepage_io+0x18b/0x360 [btrfs] extend_write_locked_range+0x17c/0x340 [btrfs] ? __pfx_end_bbio_data_write+0x10/0x10 [btrfs] run_delalloc_cow+0x71/0xd0 [btrfs] btrfs_run_delalloc_range+0x176/0x500 [btrfs] ? buscar_bloqueo_desbloqueado_rango+0x119/0x260 [btrfs] escribir_p\u00e1gina_desbloqueado+0x2ab/0x480 [btrfs] extensi\u00f3n_escritura_p\u00e1ginas_cach\u00e9+0x236/0x7d0 [btrfs] btrfs_escritura_p\u00e1ginas+0x72/0x130 [btrfs] hacer_escritura_p\u00e1ginas+0xd4/0x240 ? buscar_bloqueo_retenido+0x2b/0x80 ? wbc_adjuntar_y_desbloquear_inodo+0x12c/0x290 ? wbc_adjuntar_y_desbloquear_inodo+0x12c/0x29 ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/btrfs/bio.c\",\"fs/btrfs/bio.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"852eee62d31abd695cd43e1b875d664ed292a8ca\",\"lessThan\":\"22833d89b780ba0f9f66e19c477e7decf638edce\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"852eee62d31abd695cd43e1b875d664ed292a8ca\",\"lessThan\":\"d48e1dea3931de64c26717adc2b89743c7ab6594\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/btrfs/bio.c\",\"fs/btrfs/bio.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11.7\",\"lessThanOrEqual\":\"6.11.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T20:16:54.858322Z\",\"id\":\"CVE-2024-50225\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3\",\"versionEndExcluding\":\"6.11.7\",\"matchCriteriaId\":\"5972B133-90E2-44DE-AE0B-A0939F0D914F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F361E1D-580F-4A2D-A509-7615F73167A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"925478D0-3E3D-4E6F-ACD5-09F28D5DF82C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3C95E234-D335-4B6C-96BF-E2CEBD8654ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F717D8-3014-4F84-8086-0124B2111379\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"24DBE6C7-2AAE-4818-AED2-E131F153D2FA\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/22833d89b780ba0f9f66e19c477e7decf638edce\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d48e1dea3931de64c26717adc2b89743c7ab6594\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T12:24:15+00:00",
      "cve": "CVE-2024-50225",
      "id": "CVE-2024-50225",
      "initial_release_date": "2024-11-09T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: btrfs: fix error propagation of split bios",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50225.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:10:35Z",
      "cve": "CVE-2024-50225",
      "id": "CVE-2024-50225",
      "initial_release_date": "2024-11-10T03:49:39Z",
      "product_status:known_affected": "398",
      "product_status:known_not_affected": "473",
      "product_status:recommended": "286",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-50225",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-50225.json",
      "version": "59"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-50225\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T20:16:54.858322Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:23:15.917Z\"}}], \"cna\": {\"title\": \"btrfs: fix error propagation of split bios\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"852eee62d31abd695cd43e1b875d664ed292a8ca\", \"lessThan\": \"22833d89b780ba0f9f66e19c477e7decf638edce\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"852eee62d31abd695cd43e1b875d664ed292a8ca\", \"lessThan\": \"d48e1dea3931de64c26717adc2b89743c7ab6594\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/btrfs/bio.c\", \"fs/btrfs/bio.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.3\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.3\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.11.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.11.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/btrfs/bio.c\", \"fs/btrfs/bio.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/22833d89b780ba0f9f66e19c477e7decf638edce\"}, {\"url\": \"https://git.kernel.org/stable/c/d48e1dea3931de64c26717adc2b89743c7ab6594\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix error propagation of split bios\\n\\nThe purpose of btrfs_bbio_propagate_error() shall be propagating an error\\nof split bio to its original btrfs_bio, and tell the error to the upper\\nlayer. However, it\u0027s not working well on some cases.\\n\\n* Case 1. Immediate (or quick) end_bio with an error\\n\\nWhen btrfs sends btrfs_bio to mirrored devices, btrfs calls\\nbtrfs_bio_end_io() when all the mirroring bios are completed. If that\\nbtrfs_bio was split, it is from btrfs_clone_bioset and its end_io function\\nis btrfs_orig_write_end_io. For this case, btrfs_bbio_propagate_error()\\naccesses the orig_bbio\u0027s bio context to increase the error count.\\n\\nThat works well in most cases. However, if the end_io is called enough\\nfast, orig_bbio\u0027s (remaining part after split) bio context may not be\\nproperly set at that time. Since the bio context is set when the orig_bbio\\n(the last btrfs_bio) is sent to devices, that might be too late for earlier\\nsplit btrfs_bio\u0027s completion.  That will result in NULL pointer\\ndereference.\\n\\nThat bug is easily reproducible by running btrfs/146 on zoned devices [1]\\nand it shows the following trace.\\n\\n[1] You need raid-stripe-tree feature as it create \\\"-d raid0 -m raid1\\\" FS.\\n\\n  BUG: kernel NULL pointer dereference, address: 0000000000000020\\n  #PF: supervisor read access in kernel mode\\n  #PF: error_code(0x0000) - not-present page\\n  PGD 0 P4D 0\\n  Oops: Oops: 0000 [#1] PREEMPT SMP PTI\\n  CPU: 1 UID: 0 PID: 13 Comm: kworker/u32:1 Not tainted 6.11.0-rc7-BTRFS-ZNS+ #474\\n  Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\\n  Workqueue: writeback wb_workfn (flush-btrfs-5)\\n  RIP: 0010:btrfs_bio_end_io+0xae/0xc0 [btrfs]\\n  BTRFS error (device dm-0): bdev /dev/mapper/error-test errs: wr 2, rd 0, flush 0, corrupt 0, gen 0\\n  RSP: 0018:ffffc9000006f248 EFLAGS: 00010246\\n  RAX: 0000000000000000 RBX: ffff888005a7f080 RCX: ffffc9000006f1dc\\n  RDX: 0000000000000000 RSI: 000000000000000a RDI: ffff888005a7f080\\n  RBP: ffff888011dfc540 R08: 0000000000000000 R09: 0000000000000001\\n  R10: ffffffff82e508e0 R11: 0000000000000005 R12: ffff88800ddfbe58\\n  R13: ffff888005a7f080 R14: ffff888005a7f158 R15: ffff888005a7f158\\n  FS:  0000000000000000(0000) GS:ffff88803ea80000(0000) knlGS:0000000000000000\\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\n  CR2: 0000000000000020 CR3: 0000000002e22006 CR4: 0000000000370ef0\\n  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\\n  DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\\n  Call Trace:\\n   \u003cTASK\u003e\\n   ? __die_body.cold+0x19/0x26\\n   ? page_fault_oops+0x13e/0x2b0\\n   ? _printk+0x58/0x73\\n   ? do_user_addr_fault+0x5f/0x750\\n   ? exc_page_fault+0x76/0x240\\n   ? asm_exc_page_fault+0x22/0x30\\n   ? btrfs_bio_end_io+0xae/0xc0 [btrfs]\\n   ? btrfs_log_dev_io_error+0x7f/0x90 [btrfs]\\n   btrfs_orig_write_end_io+0x51/0x90 [btrfs]\\n   dm_submit_bio+0x5c2/0xa50 [dm_mod]\\n   ? find_held_lock+0x2b/0x80\\n   ? blk_try_enter_queue+0x90/0x1e0\\n   __submit_bio+0xe0/0x130\\n   ? ktime_get+0x10a/0x160\\n   ? lockdep_hardirqs_on+0x74/0x100\\n   submit_bio_noacct_nocheck+0x199/0x410\\n   btrfs_submit_bio+0x7d/0x150 [btrfs]\\n   btrfs_submit_chunk+0x1a1/0x6d0 [btrfs]\\n   ? lockdep_hardirqs_on+0x74/0x100\\n   ? __folio_start_writeback+0x10/0x2c0\\n   btrfs_submit_bbio+0x1c/0x40 [btrfs]\\n   submit_one_bio+0x44/0x60 [btrfs]\\n   submit_extent_folio+0x13f/0x330 [btrfs]\\n   ? btrfs_set_range_writeback+0xa3/0xd0 [btrfs]\\n   extent_writepage_io+0x18b/0x360 [btrfs]\\n   extent_write_locked_range+0x17c/0x340 [btrfs]\\n   ? __pfx_end_bbio_data_write+0x10/0x10 [btrfs]\\n   run_delalloc_cow+0x71/0xd0 [btrfs]\\n   btrfs_run_delalloc_range+0x176/0x500 [btrfs]\\n   ? find_lock_delalloc_range+0x119/0x260 [btrfs]\\n   writepage_delalloc+0x2ab/0x480 [btrfs]\\n   extent_write_cache_pages+0x236/0x7d0 [btrfs]\\n   btrfs_writepages+0x72/0x130 [btrfs]\\n   do_writepages+0xd4/0x240\\n   ? find_held_lock+0x2b/0x80\\n   ? wbc_attach_and_unlock_inode+0x12c/0x290\\n   ? wbc_attach_and_unlock_inode+0x12c/0x29\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11.7\", \"versionStartIncluding\": \"6.3\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12\", \"versionStartIncluding\": \"6.3\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:49:11.405Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-50225\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-01T20:17:28.196Z\", \"dateReserved\": \"2024-10-21T19:36:19.973Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-11-09T10:14:36.065Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.