GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-56582 (GCVE-0-2024-56582)

Vulnerability from cvelistv5 – Published: 2024-12-27 14:23 – Updated: 2026-05-11 20:55
VLAI
Title
btrfs: fix use-after-free in btrfs_encoded_read_endio()
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free in btrfs_encoded_read_endio() Shinichiro reported the following use-after free that sometimes is happening in our CI system when running fstests' btrfs/284 on a TCMU runner device: BUG: KASAN: slab-use-after-free in lock_release+0x708/0x780 Read of size 8 at addr ffff888106a83f18 by task kworker/u80:6/219 CPU: 8 UID: 0 PID: 219 Comm: kworker/u80:6 Not tainted 6.12.0-rc6-kts+ #15 Hardware name: Supermicro Super Server/X11SPi-TF, BIOS 3.3 02/21/2020 Workqueue: btrfs-endio btrfs_end_bio_work [btrfs] Call Trace: <TASK> dump_stack_lvl+0x6e/0xa0 ? lock_release+0x708/0x780 print_report+0x174/0x505 ? lock_release+0x708/0x780 ? __virt_addr_valid+0x224/0x410 ? lock_release+0x708/0x780 kasan_report+0xda/0x1b0 ? lock_release+0x708/0x780 ? __wake_up+0x44/0x60 lock_release+0x708/0x780 ? __pfx_lock_release+0x10/0x10 ? __pfx_do_raw_spin_lock+0x10/0x10 ? lock_is_held_type+0x9a/0x110 _raw_spin_unlock_irqrestore+0x1f/0x60 __wake_up+0x44/0x60 btrfs_encoded_read_endio+0x14b/0x190 [btrfs] btrfs_check_read_bio+0x8d9/0x1360 [btrfs] ? lock_release+0x1b0/0x780 ? trace_lock_acquire+0x12f/0x1a0 ? __pfx_btrfs_check_read_bio+0x10/0x10 [btrfs] ? process_one_work+0x7e3/0x1460 ? lock_acquire+0x31/0xc0 ? process_one_work+0x7e3/0x1460 process_one_work+0x85c/0x1460 ? __pfx_process_one_work+0x10/0x10 ? assign_work+0x16c/0x240 worker_thread+0x5e6/0xfc0 ? __pfx_worker_thread+0x10/0x10 kthread+0x2c3/0x3a0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x31/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 3661: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 btrfs_encoded_read_regular_fill_pages+0x16c/0x6d0 [btrfs] send_extent_data+0xf0f/0x24a0 [btrfs] process_extent+0x48a/0x1830 [btrfs] changed_cb+0x178b/0x2ea0 [btrfs] btrfs_ioctl_send+0x3bf9/0x5c20 [btrfs] _btrfs_ioctl_send+0x117/0x330 [btrfs] btrfs_ioctl+0x184a/0x60a0 [btrfs] __x64_sys_ioctl+0x12e/0x1a0 do_syscall_64+0x95/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 3661: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x70 __kasan_slab_free+0x4f/0x70 kfree+0x143/0x490 btrfs_encoded_read_regular_fill_pages+0x531/0x6d0 [btrfs] send_extent_data+0xf0f/0x24a0 [btrfs] process_extent+0x48a/0x1830 [btrfs] changed_cb+0x178b/0x2ea0 [btrfs] btrfs_ioctl_send+0x3bf9/0x5c20 [btrfs] _btrfs_ioctl_send+0x117/0x330 [btrfs] btrfs_ioctl+0x184a/0x60a0 [btrfs] __x64_sys_ioctl+0x12e/0x1a0 do_syscall_64+0x95/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e The buggy address belongs to the object at ffff888106a83f00 which belongs to the cache kmalloc-rnd-07-96 of size 96 The buggy address is located 24 bytes inside of freed 96-byte region [ffff888106a83f00, ffff888106a83f60) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888106a83800 pfn:0x106a83 flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) page_type: f5(slab) raw: 0017ffffc0000000 ffff888100053680 ffffea0004917200 0000000000000004 raw: ffff888106a83800 0000000080200019 00000001f5000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888106a83e00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff888106a83e80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc >ffff888106a83f00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff888106a83f80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff888106a84000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== Further analyzing the trace and ---truncated---
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-02-11 15:42 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1881fba89bd5dcd364d2e1bf561912a90a11c21a , < a40de0330af4fb7bc6b354250c24f294f8b826a0 (git)
Affected: 1881fba89bd5dcd364d2e1bf561912a90a11c21a , < 6228f13f1996a4feb9b601d6644bf0bfe03671dd (git)
Affected: 1881fba89bd5dcd364d2e1bf561912a90a11c21a , < f8a5129e4a9fc3f6aa3f137513253b51b31b94d4 (git)
Affected: 1881fba89bd5dcd364d2e1bf561912a90a11c21a , < 05b36b04d74a517d6675bf2f90829ff1ac7e28dc (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.1.124 , ≤ 6.1.* (semver)
Unaffected: 6.6.70 , ≤ 6.6.* (semver)
Unaffected: 6.12.4 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56582",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-11T15:42:35.022378Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-11T15:45:24.334Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:49:59.647Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a40de0330af4fb7bc6b354250c24f294f8b826a0",
              "status": "affected",
              "version": "1881fba89bd5dcd364d2e1bf561912a90a11c21a",
              "versionType": "git"
            },
            {
              "lessThan": "6228f13f1996a4feb9b601d6644bf0bfe03671dd",
              "status": "affected",
              "version": "1881fba89bd5dcd364d2e1bf561912a90a11c21a",
              "versionType": "git"
            },
            {
              "lessThan": "f8a5129e4a9fc3f6aa3f137513253b51b31b94d4",
              "status": "affected",
              "version": "1881fba89bd5dcd364d2e1bf561912a90a11c21a",
              "versionType": "git"
            },
            {
              "lessThan": "05b36b04d74a517d6675bf2f90829ff1ac7e28dc",
              "status": "affected",
              "version": "1881fba89bd5dcd364d2e1bf561912a90a11c21a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.124",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.124",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.70",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.4",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free in btrfs_encoded_read_endio()\n\nShinichiro reported the following use-after free that sometimes is\nhappening in our CI system when running fstests\u0027 btrfs/284 on a TCMU\nrunner device:\n\n  BUG: KASAN: slab-use-after-free in lock_release+0x708/0x780\n  Read of size 8 at addr ffff888106a83f18 by task kworker/u80:6/219\n\n  CPU: 8 UID: 0 PID: 219 Comm: kworker/u80:6 Not tainted 6.12.0-rc6-kts+ #15\n  Hardware name: Supermicro Super Server/X11SPi-TF, BIOS 3.3 02/21/2020\n  Workqueue: btrfs-endio btrfs_end_bio_work [btrfs]\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x6e/0xa0\n   ? lock_release+0x708/0x780\n   print_report+0x174/0x505\n   ? lock_release+0x708/0x780\n   ? __virt_addr_valid+0x224/0x410\n   ? lock_release+0x708/0x780\n   kasan_report+0xda/0x1b0\n   ? lock_release+0x708/0x780\n   ? __wake_up+0x44/0x60\n   lock_release+0x708/0x780\n   ? __pfx_lock_release+0x10/0x10\n   ? __pfx_do_raw_spin_lock+0x10/0x10\n   ? lock_is_held_type+0x9a/0x110\n   _raw_spin_unlock_irqrestore+0x1f/0x60\n   __wake_up+0x44/0x60\n   btrfs_encoded_read_endio+0x14b/0x190 [btrfs]\n   btrfs_check_read_bio+0x8d9/0x1360 [btrfs]\n   ? lock_release+0x1b0/0x780\n   ? trace_lock_acquire+0x12f/0x1a0\n   ? __pfx_btrfs_check_read_bio+0x10/0x10 [btrfs]\n   ? process_one_work+0x7e3/0x1460\n   ? lock_acquire+0x31/0xc0\n   ? process_one_work+0x7e3/0x1460\n   process_one_work+0x85c/0x1460\n   ? __pfx_process_one_work+0x10/0x10\n   ? assign_work+0x16c/0x240\n   worker_thread+0x5e6/0xfc0\n   ? __pfx_worker_thread+0x10/0x10\n   kthread+0x2c3/0x3a0\n   ? __pfx_kthread+0x10/0x10\n   ret_from_fork+0x31/0x70\n   ? __pfx_kthread+0x10/0x10\n   ret_from_fork_asm+0x1a/0x30\n   \u003c/TASK\u003e\n\n  Allocated by task 3661:\n   kasan_save_stack+0x30/0x50\n   kasan_save_track+0x14/0x30\n   __kasan_kmalloc+0xaa/0xb0\n   btrfs_encoded_read_regular_fill_pages+0x16c/0x6d0 [btrfs]\n   send_extent_data+0xf0f/0x24a0 [btrfs]\n   process_extent+0x48a/0x1830 [btrfs]\n   changed_cb+0x178b/0x2ea0 [btrfs]\n   btrfs_ioctl_send+0x3bf9/0x5c20 [btrfs]\n   _btrfs_ioctl_send+0x117/0x330 [btrfs]\n   btrfs_ioctl+0x184a/0x60a0 [btrfs]\n   __x64_sys_ioctl+0x12e/0x1a0\n   do_syscall_64+0x95/0x180\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n  Freed by task 3661:\n   kasan_save_stack+0x30/0x50\n   kasan_save_track+0x14/0x30\n   kasan_save_free_info+0x3b/0x70\n   __kasan_slab_free+0x4f/0x70\n   kfree+0x143/0x490\n   btrfs_encoded_read_regular_fill_pages+0x531/0x6d0 [btrfs]\n   send_extent_data+0xf0f/0x24a0 [btrfs]\n   process_extent+0x48a/0x1830 [btrfs]\n   changed_cb+0x178b/0x2ea0 [btrfs]\n   btrfs_ioctl_send+0x3bf9/0x5c20 [btrfs]\n   _btrfs_ioctl_send+0x117/0x330 [btrfs]\n   btrfs_ioctl+0x184a/0x60a0 [btrfs]\n   __x64_sys_ioctl+0x12e/0x1a0\n   do_syscall_64+0x95/0x180\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\n  The buggy address belongs to the object at ffff888106a83f00\n   which belongs to the cache kmalloc-rnd-07-96 of size 96\n  The buggy address is located 24 bytes inside of\n   freed 96-byte region [ffff888106a83f00, ffff888106a83f60)\n\n  The buggy address belongs to the physical page:\n  page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888106a83800 pfn:0x106a83\n  flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff)\n  page_type: f5(slab)\n  raw: 0017ffffc0000000 ffff888100053680 ffffea0004917200 0000000000000004\n  raw: ffff888106a83800 0000000080200019 00000001f5000000 0000000000000000\n  page dumped because: kasan: bad access detected\n\n  Memory state around the buggy address:\n   ffff888106a83e00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\n   ffff888106a83e80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\n  \u003effff888106a83f00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\n                              ^\n   ffff888106a83f80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\n   ffff888106a84000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n  ==================================================================\n\nFurther analyzing the trace and \n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:55:14.844Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a40de0330af4fb7bc6b354250c24f294f8b826a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/6228f13f1996a4feb9b601d6644bf0bfe03671dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8a5129e4a9fc3f6aa3f137513253b51b31b94d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/05b36b04d74a517d6675bf2f90829ff1ac7e28dc"
        }
      ],
      "title": "btrfs: fix use-after-free in btrfs_encoded_read_endio()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56582",
    "datePublished": "2024-12-27T14:23:23.851Z",
    "dateReserved": "2024-12-27T14:03:06.000Z",
    "dateUpdated": "2026-05-11T20:55:14.844Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56582",
      "date": "2026-09-16",
      "epss": "0.00237",
      "percentile": "0.14876"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix use-after-free in btrfs_encoded_read_endio()\\n\\nShinichiro reported the following use-after free that sometimes is\\nhappening in our CI system when running fstests\u0027 btrfs/284 on a TCMU\\nrunner device:\\n\\n  BUG: KASAN: slab-use-after-free in lock_release+0x708/0x780\\n  Read of size 8 at addr ffff888106a83f18 by task kworker/u80:6/219\\n\\n  CPU: 8 UID: 0 PID: 219 Comm: kworker/u80:6 Not tainted 6.12.0-rc6-kts+ #15\\n  Hardware name: Supermicro Super Server/X11SPi-TF, BIOS 3.3 02/21/2020\\n  Workqueue: btrfs-endio btrfs_end_bio_work [btrfs]\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0x6e/0xa0\\n   ? lock_release+0x708/0x780\\n   print_report+0x174/0x505\\n   ? lock_release+0x708/0x780\\n   ? __virt_addr_valid+0x224/0x410\\n   ? lock_release+0x708/0x780\\n   kasan_report+0xda/0x1b0\\n   ? lock_release+0x708/0x780\\n   ? __wake_up+0x44/0x60\\n   lock_release+0x708/0x780\\n   ? __pfx_lock_release+0x10/0x10\\n   ? __pfx_do_raw_spin_lock+0x10/0x10\\n   ? lock_is_held_type+0x9a/0x110\\n   _raw_spin_unlock_irqrestore+0x1f/0x60\\n   __wake_up+0x44/0x60\\n   btrfs_encoded_read_endio+0x14b/0x190 [btrfs]\\n   btrfs_check_read_bio+0x8d9/0x1360 [btrfs]\\n   ? lock_release+0x1b0/0x780\\n   ? trace_lock_acquire+0x12f/0x1a0\\n   ? __pfx_btrfs_check_read_bio+0x10/0x10 [btrfs]\\n   ? process_one_work+0x7e3/0x1460\\n   ? lock_acquire+0x31/0xc0\\n   ? process_one_work+0x7e3/0x1460\\n   process_one_work+0x85c/0x1460\\n   ? __pfx_process_one_work+0x10/0x10\\n   ? assign_work+0x16c/0x240\\n   worker_thread+0x5e6/0xfc0\\n   ? __pfx_worker_thread+0x10/0x10\\n   kthread+0x2c3/0x3a0\\n   ? __pfx_kthread+0x10/0x10\\n   ret_from_fork+0x31/0x70\\n   ? __pfx_kthread+0x10/0x10\\n   ret_from_fork_asm+0x1a/0x30\\n   \u003c/TASK\u003e\\n\\n  Allocated by task 3661:\\n   kasan_save_stack+0x30/0x50\\n   kasan_save_track+0x14/0x30\\n   __kasan_kmalloc+0xaa/0xb0\\n   btrfs_encoded_read_regular_fill_pages+0x16c/0x6d0 [btrfs]\\n   send_extent_data+0xf0f/0x24a0 [btrfs]\\n   process_extent+0x48a/0x1830 [btrfs]\\n   changed_cb+0x178b/0x2ea0 [btrfs]\\n   btrfs_ioctl_send+0x3bf9/0x5c20 [btrfs]\\n   _btrfs_ioctl_send+0x117/0x330 [btrfs]\\n   btrfs_ioctl+0x184a/0x60a0 [btrfs]\\n   __x64_sys_ioctl+0x12e/0x1a0\\n   do_syscall_64+0x95/0x180\\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\n  Freed by task 3661:\\n   kasan_save_stack+0x30/0x50\\n   kasan_save_track+0x14/0x30\\n   kasan_save_free_info+0x3b/0x70\\n   __kasan_slab_free+0x4f/0x70\\n   kfree+0x143/0x490\\n   btrfs_encoded_read_regular_fill_pages+0x531/0x6d0 [btrfs]\\n   send_extent_data+0xf0f/0x24a0 [btrfs]\\n   process_extent+0x48a/0x1830 [btrfs]\\n   changed_cb+0x178b/0x2ea0 [btrfs]\\n   btrfs_ioctl_send+0x3bf9/0x5c20 [btrfs]\\n   _btrfs_ioctl_send+0x117/0x330 [btrfs]\\n   btrfs_ioctl+0x184a/0x60a0 [btrfs]\\n   __x64_sys_ioctl+0x12e/0x1a0\\n   do_syscall_64+0x95/0x180\\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\n  The buggy address belongs to the object at ffff888106a83f00\\n   which belongs to the cache kmalloc-rnd-07-96 of size 96\\n  The buggy address is located 24 bytes inside of\\n   freed 96-byte region [ffff888106a83f00, ffff888106a83f60)\\n\\n  The buggy address belongs to the physical page:\\n  page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888106a83800 pfn:0x106a83\\n  flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff)\\n  page_type: f5(slab)\\n  raw: 0017ffffc0000000 ffff888100053680 ffffea0004917200 0000000000000004\\n  raw: ffff888106a83800 0000000080200019 00000001f5000000 0000000000000000\\n  page dumped because: kasan: bad access detected\\n\\n  Memory state around the buggy address:\\n   ffff888106a83e00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\\n   ffff888106a83e80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\\n  \u003effff888106a83f00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\\n                              ^\\n   ffff888106a83f80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\\n   ffff888106a84000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\\n  ==================================================================\\n\\nFurther analyzing the trace and \\n---truncated---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: correcci\\u00f3n de use-after-free en btrfs_encoded_read_endio() Shinichiro inform\\u00f3 el siguiente use-after-free que a veces sucede en nuestro sistema CI cuando se ejecuta btrfs/284 de fstests en un dispositivo ejecutor de TCMU: ERROR: KASAN: slab-use-after-free en lock_release+0x708/0x780 Lectura de tama\\u00f1o 8 en la direcci\\u00f3n ffff888106a83f18 por la tarea kworker/u80:6/219 CPU: 8 UID: 0 PID: 219 Comm: kworker/u80:6 No contaminado 6.12.0-rc6-kts+ #15 Nombre del hardware: Supermicro Super Server/X11SPi-TF, BIOS 3.3 21/02/2020 Cola de trabajo: btrfs-endio btrfs_end_bio_work [btrfs] Seguimiento de llamadas:  dump_stack_lvl+0x6e/0xa0 ? lock_release+0x708/0x780 print_report+0x174/0x505 ? lock_release+0x708/0x780 ? __virt_addr_valid+0x224/0x410 ? lock_release+0x708/0x780 kasan_report+0xda/0x1b0 ? lock_release+0x708/0x780 ? __wake_up+0x44/0x60 lock_release+0x708/0x780 ? __pfx_lock_release+0x10/0x10 ? __pfx_do_raw_spin_lock+0x10/0x10 ? bloqueo_se_retiene_tipo+0x9a/0x110 _raw_spin_unlock_irqrestore+0x1f/0x60 __wake_up+0x44/0x60 btrfs_encoded_read_endio+0x14b/0x190 [btrfs] btrfs_check_read_bio+0x8d9/0x1360 [btrfs] ? bloqueo_liberaci\\u00f3n+0x1b0/0x780 ? trace_lock_acquire+0x12f/0x1a0 ? __pfx_btrfs_check_read_bio+0x10/0x10 [btrfs] ? proceso_una_obra+0x7e3/0x1460 ? bloqueo_adquirir+0x31/0xc0 ? proceso_uno_trabajo+0x7e3/0x1460 proceso_uno_trabajo+0x85c/0x1460 ? __pfx_proceso_uno_trabajo+0x10/0x10 ? asignar_trabajo+0x16c/0x240 subproceso_trabajador+0x5e6/0xfc0 ? __pfx_subproceso_trabajador+0x10/0x10 kthread+0x2c3/0x3a0 ? __pfx_kthread+0x10/0x10 retirar_de_bifurcaci\\u00f3n+0x31/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30  Asignado por la tarea 3661: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 btrfs_encoded_read_regular_fill_pages+0x16c/0x6d0 [btrfs] send_extent_data+0xf0f/0x24a0 [btrfs] process_extent+0x48a/0x1830 [btrfs] changed_cb+0x178b/0x2ea0 [btrfs] btrfs_ioctl_send+0x3bf9/0x5c20 [btrfs] _btrfs_ioctl_send+0x117/0x330 [btrfs] btrfs_ioctl+0x184a/0x60a0 [btrfs] __x64_sys_ioctl+0x12e/0x1a0 do_syscall_64+0x95/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Liberado por la tarea 3661: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x70 __kasan_slab_free+0x4f/0x70 kfree+0x143/0x490 btrfs_encoded_read_regular_fill_pages+0x531/0x6d0 [btrfs] enviar_datos_de_extensi\\u00f3n+0xf0f/0x24a0 [btrfs] procesar_extensi\\u00f3n+0x48a/0x1830 [btrfs] cambiar_cb+0x178b/0x2ea0 [btrfs] btrfs_ioctl_send+0x3bf9/0x5c20 [btrfs] _btrfs_ioctl_send+0x117/0x330 [btrfs] btrfs_ioctl+0x184a/0x60a0 [btrfs] __x64_sys_ioctl+0x12e/0x1a0 hacer_llamada_al_sistema_64+0x95/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e La direcci\\u00f3n con errores pertenece al objeto en ffff888106a83f00 que pertenece a la cach\\u00e9 kmalloc-rnd-07-96 de tama\\u00f1o 96 La direcci\\u00f3n con errores se encuentra 24 bytes dentro de la regi\\u00f3n liberada de 96 bytes [ffff888106a83f00, ffff888106a83f60) La direcci\\u00f3n con errores pertenece a la p\\u00e1gina f\\u00edsica: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888106a83800 pfn:0x106a83 flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) page_type: f5(slab) raw: 0017ffffc0000000 ffff888100053680 ffffea0004917200 0000000000000004 sin procesar: ffff888106a83800 0000000080200019 00000001f5000000 0000000000000000 p\\u00e1gina volcada porque: kasan: se detect\\u00f3 un acceso incorrecto Estado de la memoria alrededor de la direcci\\u00f3n con errores: ffff888106a83e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc ffff888106a83e80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc \u0026gt;ffff888106a83f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff888106a83f80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc ffff888106a84000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 == ...\"}]",
      "id": "CVE-2024-56582",
      "lastModified": "2025-01-09T16:16:21.920",
      "published": "2024-12-27T15:15:17.333",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/05b36b04d74a517d6675bf2f90829ff1ac7e28dc\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/6228f13f1996a4feb9b601d6644bf0bfe03671dd\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a40de0330af4fb7bc6b354250c24f294f8b826a0\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/f8a5129e4a9fc3f6aa3f137513253b51b31b94d4\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Undergoing Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-19T01:48:51.000Z",
      "cve": "CVE-2024-56582",
      "id": "msrc_CVE-2024-56582",
      "initial_release_date": "2024-12-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "btrfs: fix use-after-free in btrfs_encoded_read_endio()",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-56582.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56582\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-27T15:15:17.333\",\"lastModified\":\"2026-06-17T08:12:28.167\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix use-after-free in btrfs_encoded_read_endio()\\n\\nShinichiro reported the following use-after free that sometimes is\\nhappening in our CI system when running fstests\u0027 btrfs/284 on a TCMU\\nrunner device:\\n\\n  BUG: KASAN: slab-use-after-free in lock_release+0x708/0x780\\n  Read of size 8 at addr ffff888106a83f18 by task kworker/u80:6/219\\n\\n  CPU: 8 UID: 0 PID: 219 Comm: kworker/u80:6 Not tainted 6.12.0-rc6-kts+ #15\\n  Hardware name: Supermicro Super Server/X11SPi-TF, BIOS 3.3 02/21/2020\\n  Workqueue: btrfs-endio btrfs_end_bio_work [btrfs]\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0x6e/0xa0\\n   ? lock_release+0x708/0x780\\n   print_report+0x174/0x505\\n   ? lock_release+0x708/0x780\\n   ? __virt_addr_valid+0x224/0x410\\n   ? lock_release+0x708/0x780\\n   kasan_report+0xda/0x1b0\\n   ? lock_release+0x708/0x780\\n   ? __wake_up+0x44/0x60\\n   lock_release+0x708/0x780\\n   ? __pfx_lock_release+0x10/0x10\\n   ? __pfx_do_raw_spin_lock+0x10/0x10\\n   ? lock_is_held_type+0x9a/0x110\\n   _raw_spin_unlock_irqrestore+0x1f/0x60\\n   __wake_up+0x44/0x60\\n   btrfs_encoded_read_endio+0x14b/0x190 [btrfs]\\n   btrfs_check_read_bio+0x8d9/0x1360 [btrfs]\\n   ? lock_release+0x1b0/0x780\\n   ? trace_lock_acquire+0x12f/0x1a0\\n   ? __pfx_btrfs_check_read_bio+0x10/0x10 [btrfs]\\n   ? process_one_work+0x7e3/0x1460\\n   ? lock_acquire+0x31/0xc0\\n   ? process_one_work+0x7e3/0x1460\\n   process_one_work+0x85c/0x1460\\n   ? __pfx_process_one_work+0x10/0x10\\n   ? assign_work+0x16c/0x240\\n   worker_thread+0x5e6/0xfc0\\n   ? __pfx_worker_thread+0x10/0x10\\n   kthread+0x2c3/0x3a0\\n   ? __pfx_kthread+0x10/0x10\\n   ret_from_fork+0x31/0x70\\n   ? __pfx_kthread+0x10/0x10\\n   ret_from_fork_asm+0x1a/0x30\\n   \u003c/TASK\u003e\\n\\n  Allocated by task 3661:\\n   kasan_save_stack+0x30/0x50\\n   kasan_save_track+0x14/0x30\\n   __kasan_kmalloc+0xaa/0xb0\\n   btrfs_encoded_read_regular_fill_pages+0x16c/0x6d0 [btrfs]\\n   send_extent_data+0xf0f/0x24a0 [btrfs]\\n   process_extent+0x48a/0x1830 [btrfs]\\n   changed_cb+0x178b/0x2ea0 [btrfs]\\n   btrfs_ioctl_send+0x3bf9/0x5c20 [btrfs]\\n   _btrfs_ioctl_send+0x117/0x330 [btrfs]\\n   btrfs_ioctl+0x184a/0x60a0 [btrfs]\\n   __x64_sys_ioctl+0x12e/0x1a0\\n   do_syscall_64+0x95/0x180\\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\n  Freed by task 3661:\\n   kasan_save_stack+0x30/0x50\\n   kasan_save_track+0x14/0x30\\n   kasan_save_free_info+0x3b/0x70\\n   __kasan_slab_free+0x4f/0x70\\n   kfree+0x143/0x490\\n   btrfs_encoded_read_regular_fill_pages+0x531/0x6d0 [btrfs]\\n   send_extent_data+0xf0f/0x24a0 [btrfs]\\n   process_extent+0x48a/0x1830 [btrfs]\\n   changed_cb+0x178b/0x2ea0 [btrfs]\\n   btrfs_ioctl_send+0x3bf9/0x5c20 [btrfs]\\n   _btrfs_ioctl_send+0x117/0x330 [btrfs]\\n   btrfs_ioctl+0x184a/0x60a0 [btrfs]\\n   __x64_sys_ioctl+0x12e/0x1a0\\n   do_syscall_64+0x95/0x180\\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\n  The buggy address belongs to the object at ffff888106a83f00\\n   which belongs to the cache kmalloc-rnd-07-96 of size 96\\n  The buggy address is located 24 bytes inside of\\n   freed 96-byte region [ffff888106a83f00, ffff888106a83f60)\\n\\n  The buggy address belongs to the physical page:\\n  page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888106a83800 pfn:0x106a83\\n  flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff)\\n  page_type: f5(slab)\\n  raw: 0017ffffc0000000 ffff888100053680 ffffea0004917200 0000000000000004\\n  raw: ffff888106a83800 0000000080200019 00000001f5000000 0000000000000000\\n  page dumped because: kasan: bad access detected\\n\\n  Memory state around the buggy address:\\n   ffff888106a83e00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\\n   ffff888106a83e80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\\n  \u003effff888106a83f00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\\n                              ^\\n   ffff888106a83f80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\\n   ffff888106a84000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\\n  ==================================================================\\n\\nFurther analyzing the trace and \\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: correcci\u00f3n de use-after-free en btrfs_encoded_read_endio() Shinichiro inform\u00f3 el siguiente use-after-free que a veces sucede en nuestro sistema CI cuando se ejecuta btrfs/284 de fstests en un dispositivo ejecutor de TCMU: ERROR: KASAN: slab-use-after-free en lock_release+0x708/0x780 Lectura de tama\u00f1o 8 en la direcci\u00f3n ffff888106a83f18 por la tarea kworker/u80:6/219 CPU: 8 UID: 0 PID: 219 Comm: kworker/u80:6 No contaminado 6.12.0-rc6-kts+ #15 Nombre del hardware: Supermicro Super Server/X11SPi-TF, BIOS 3.3 21/02/2020 Cola de trabajo: btrfs-endio btrfs_end_bio_work [btrfs] Seguimiento de llamadas:  dump_stack_lvl+0x6e/0xa0 ? lock_release+0x708/0x780 print_report+0x174/0x505 ? lock_release+0x708/0x780 ? __virt_addr_valid+0x224/0x410 ? lock_release+0x708/0x780 kasan_report+0xda/0x1b0 ? lock_release+0x708/0x780 ? __wake_up+0x44/0x60 lock_release+0x708/0x780 ? __pfx_lock_release+0x10/0x10 ? __pfx_do_raw_spin_lock+0x10/0x10 ? bloqueo_se_retiene_tipo+0x9a/0x110 _raw_spin_unlock_irqrestore+0x1f/0x60 __wake_up+0x44/0x60 btrfs_encoded_read_endio+0x14b/0x190 [btrfs] btrfs_check_read_bio+0x8d9/0x1360 [btrfs] ? bloqueo_liberaci\u00f3n+0x1b0/0x780 ? trace_lock_acquire+0x12f/0x1a0 ? __pfx_btrfs_check_read_bio+0x10/0x10 [btrfs] ? proceso_una_obra+0x7e3/0x1460 ? bloqueo_adquirir+0x31/0xc0 ? proceso_uno_trabajo+0x7e3/0x1460 proceso_uno_trabajo+0x85c/0x1460 ? __pfx_proceso_uno_trabajo+0x10/0x10 ? asignar_trabajo+0x16c/0x240 subproceso_trabajador+0x5e6/0xfc0 ? __pfx_subproceso_trabajador+0x10/0x10 kthread+0x2c3/0x3a0 ? __pfx_kthread+0x10/0x10 retirar_de_bifurcaci\u00f3n+0x31/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30  Asignado por la tarea 3661: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 btrfs_encoded_read_regular_fill_pages+0x16c/0x6d0 [btrfs] send_extent_data+0xf0f/0x24a0 [btrfs] process_extent+0x48a/0x1830 [btrfs] changed_cb+0x178b/0x2ea0 [btrfs] btrfs_ioctl_send+0x3bf9/0x5c20 [btrfs] _btrfs_ioctl_send+0x117/0x330 [btrfs] btrfs_ioctl+0x184a/0x60a0 [btrfs] __x64_sys_ioctl+0x12e/0x1a0 do_syscall_64+0x95/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e Liberado por la tarea 3661: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x70 __kasan_slab_free+0x4f/0x70 kfree+0x143/0x490 btrfs_encoded_read_regular_fill_pages+0x531/0x6d0 [btrfs] enviar_datos_de_extensi\u00f3n+0xf0f/0x24a0 [btrfs] procesar_extensi\u00f3n+0x48a/0x1830 [btrfs] cambiar_cb+0x178b/0x2ea0 [btrfs] btrfs_ioctl_send+0x3bf9/0x5c20 [btrfs] _btrfs_ioctl_send+0x117/0x330 [btrfs] btrfs_ioctl+0x184a/0x60a0 [btrfs] __x64_sys_ioctl+0x12e/0x1a0 hacer_llamada_al_sistema_64+0x95/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e La direcci\u00f3n con errores pertenece al objeto en ffff888106a83f00 que pertenece a la cach\u00e9 kmalloc-rnd-07-96 de tama\u00f1o 96 La direcci\u00f3n con errores se encuentra 24 bytes dentro de la regi\u00f3n liberada de 96 bytes [ffff888106a83f00, ffff888106a83f60) La direcci\u00f3n con errores pertenece a la p\u00e1gina f\u00edsica: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888106a83800 pfn:0x106a83 flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) page_type: f5(slab) raw: 0017ffffc0000000 ffff888100053680 ffffea0004917200 0000000000000004 sin procesar: ffff888106a83800 0000000080200019 00000001f5000000 0000000000000000 p\u00e1gina volcada porque: kasan: se detect\u00f3 un acceso incorrecto Estado de la memoria alrededor de la direcci\u00f3n con errores: ffff888106a83e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc ffff888106a83e80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc \u0026gt;ffff888106a83f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff888106a83f80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc ffff888106a84000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 == ...\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/btrfs/inode.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1881fba89bd5dcd364d2e1bf561912a90a11c21a\",\"lessThan\":\"a40de0330af4fb7bc6b354250c24f294f8b826a0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1881fba89bd5dcd364d2e1bf561912a90a11c21a\",\"lessThan\":\"6228f13f1996a4feb9b601d6644bf0bfe03671dd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1881fba89bd5dcd364d2e1bf561912a90a11c21a\",\"lessThan\":\"f8a5129e4a9fc3f6aa3f137513253b51b31b94d4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1881fba89bd5dcd364d2e1bf561912a90a11c21a\",\"lessThan\":\"05b36b04d74a517d6675bf2f90829ff1ac7e28dc\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/btrfs/inode.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.124\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.70\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.4\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-11T15:42:35.022378Z\",\"id\":\"CVE-2024-56582\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"6.1.124\",\"matchCriteriaId\":\"FBF74D22-8ED5-4148-92BD-FFCDBB9D35CA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.70\",\"matchCriteriaId\":\"51E6CFF2-92AA-4936-95AB-2D068168A696\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.4\",\"matchCriteriaId\":\"04756810-D093-4B43-B1D9-CF5035968061\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/05b36b04d74a517d6675bf2f90829ff1ac7e28dc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6228f13f1996a4feb9b601d6644bf0bfe03671dd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a40de0330af4fb7bc6b354250c24f294f8b826a0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f8a5129e4a9fc3f6aa3f137513253b51b31b94d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T13:51:44+00:00",
      "cve": "CVE-2024-56582",
      "id": "CVE-2024-56582",
      "initial_release_date": "2024-12-27T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: btrfs: fix use-after-free in btrfs_encoded_read_endio()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56582.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-11T02:07:06Z",
      "cve": "CVE-2024-56582",
      "id": "CVE-2024-56582",
      "initial_release_date": "2024-12-28T03:48:26Z",
      "product_status:known_affected": "398",
      "product_status:known_not_affected": "512",
      "product_status:recommended": "382",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-56582",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-56582.json",
      "version": "75"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T20:49:59.647Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-56582\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-11T15:42:35.022378Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-11T15:42:36.415Z\"}}], \"cna\": {\"title\": \"btrfs: fix use-after-free in btrfs_encoded_read_endio()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"1881fba89bd5dcd364d2e1bf561912a90a11c21a\", \"lessThan\": \"a40de0330af4fb7bc6b354250c24f294f8b826a0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1881fba89bd5dcd364d2e1bf561912a90a11c21a\", \"lessThan\": \"6228f13f1996a4feb9b601d6644bf0bfe03671dd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1881fba89bd5dcd364d2e1bf561912a90a11c21a\", \"lessThan\": \"f8a5129e4a9fc3f6aa3f137513253b51b31b94d4\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1881fba89bd5dcd364d2e1bf561912a90a11c21a\", \"lessThan\": \"05b36b04d74a517d6675bf2f90829ff1ac7e28dc\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/btrfs/inode.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.18\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.18\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.1.124\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.70\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/btrfs/inode.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/a40de0330af4fb7bc6b354250c24f294f8b826a0\"}, {\"url\": \"https://git.kernel.org/stable/c/6228f13f1996a4feb9b601d6644bf0bfe03671dd\"}, {\"url\": \"https://git.kernel.org/stable/c/f8a5129e4a9fc3f6aa3f137513253b51b31b94d4\"}, {\"url\": \"https://git.kernel.org/stable/c/05b36b04d74a517d6675bf2f90829ff1ac7e28dc\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix use-after-free in btrfs_encoded_read_endio()\\n\\nShinichiro reported the following use-after free that sometimes is\\nhappening in our CI system when running fstests\u0027 btrfs/284 on a TCMU\\nrunner device:\\n\\n  BUG: KASAN: slab-use-after-free in lock_release+0x708/0x780\\n  Read of size 8 at addr ffff888106a83f18 by task kworker/u80:6/219\\n\\n  CPU: 8 UID: 0 PID: 219 Comm: kworker/u80:6 Not tainted 6.12.0-rc6-kts+ #15\\n  Hardware name: Supermicro Super Server/X11SPi-TF, BIOS 3.3 02/21/2020\\n  Workqueue: btrfs-endio btrfs_end_bio_work [btrfs]\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0x6e/0xa0\\n   ? lock_release+0x708/0x780\\n   print_report+0x174/0x505\\n   ? lock_release+0x708/0x780\\n   ? __virt_addr_valid+0x224/0x410\\n   ? lock_release+0x708/0x780\\n   kasan_report+0xda/0x1b0\\n   ? lock_release+0x708/0x780\\n   ? __wake_up+0x44/0x60\\n   lock_release+0x708/0x780\\n   ? __pfx_lock_release+0x10/0x10\\n   ? __pfx_do_raw_spin_lock+0x10/0x10\\n   ? lock_is_held_type+0x9a/0x110\\n   _raw_spin_unlock_irqrestore+0x1f/0x60\\n   __wake_up+0x44/0x60\\n   btrfs_encoded_read_endio+0x14b/0x190 [btrfs]\\n   btrfs_check_read_bio+0x8d9/0x1360 [btrfs]\\n   ? lock_release+0x1b0/0x780\\n   ? trace_lock_acquire+0x12f/0x1a0\\n   ? __pfx_btrfs_check_read_bio+0x10/0x10 [btrfs]\\n   ? process_one_work+0x7e3/0x1460\\n   ? lock_acquire+0x31/0xc0\\n   ? process_one_work+0x7e3/0x1460\\n   process_one_work+0x85c/0x1460\\n   ? __pfx_process_one_work+0x10/0x10\\n   ? assign_work+0x16c/0x240\\n   worker_thread+0x5e6/0xfc0\\n   ? __pfx_worker_thread+0x10/0x10\\n   kthread+0x2c3/0x3a0\\n   ? __pfx_kthread+0x10/0x10\\n   ret_from_fork+0x31/0x70\\n   ? __pfx_kthread+0x10/0x10\\n   ret_from_fork_asm+0x1a/0x30\\n   \u003c/TASK\u003e\\n\\n  Allocated by task 3661:\\n   kasan_save_stack+0x30/0x50\\n   kasan_save_track+0x14/0x30\\n   __kasan_kmalloc+0xaa/0xb0\\n   btrfs_encoded_read_regular_fill_pages+0x16c/0x6d0 [btrfs]\\n   send_extent_data+0xf0f/0x24a0 [btrfs]\\n   process_extent+0x48a/0x1830 [btrfs]\\n   changed_cb+0x178b/0x2ea0 [btrfs]\\n   btrfs_ioctl_send+0x3bf9/0x5c20 [btrfs]\\n   _btrfs_ioctl_send+0x117/0x330 [btrfs]\\n   btrfs_ioctl+0x184a/0x60a0 [btrfs]\\n   __x64_sys_ioctl+0x12e/0x1a0\\n   do_syscall_64+0x95/0x180\\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\n  Freed by task 3661:\\n   kasan_save_stack+0x30/0x50\\n   kasan_save_track+0x14/0x30\\n   kasan_save_free_info+0x3b/0x70\\n   __kasan_slab_free+0x4f/0x70\\n   kfree+0x143/0x490\\n   btrfs_encoded_read_regular_fill_pages+0x531/0x6d0 [btrfs]\\n   send_extent_data+0xf0f/0x24a0 [btrfs]\\n   process_extent+0x48a/0x1830 [btrfs]\\n   changed_cb+0x178b/0x2ea0 [btrfs]\\n   btrfs_ioctl_send+0x3bf9/0x5c20 [btrfs]\\n   _btrfs_ioctl_send+0x117/0x330 [btrfs]\\n   btrfs_ioctl+0x184a/0x60a0 [btrfs]\\n   __x64_sys_ioctl+0x12e/0x1a0\\n   do_syscall_64+0x95/0x180\\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n\\n  The buggy address belongs to the object at ffff888106a83f00\\n   which belongs to the cache kmalloc-rnd-07-96 of size 96\\n  The buggy address is located 24 bytes inside of\\n   freed 96-byte region [ffff888106a83f00, ffff888106a83f60)\\n\\n  The buggy address belongs to the physical page:\\n  page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888106a83800 pfn:0x106a83\\n  flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff)\\n  page_type: f5(slab)\\n  raw: 0017ffffc0000000 ffff888100053680 ffffea0004917200 0000000000000004\\n  raw: ffff888106a83800 0000000080200019 00000001f5000000 0000000000000000\\n  page dumped because: kasan: bad access detected\\n\\n  Memory state around the buggy address:\\n   ffff888106a83e00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\\n   ffff888106a83e80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\\n  \u003effff888106a83f00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\\n                              ^\\n   ffff888106a83f80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\\n   ffff888106a84000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\\n  ==================================================================\\n\\nFurther analyzing the trace and \\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.124\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.70\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.4\", \"versionStartIncluding\": \"5.18\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"5.18\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:55:14.844Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-56582\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:55:14.844Z\", \"dateReserved\": \"2024-12-27T14:03:06.000Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-12-27T14:23:23.851Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.