CVE-2024-56759 (GCVE-0-2024-56759)

Vulnerability from cvelistv5 – Published: 2025-01-06 16:20 – Updated: 2026-08-05 11:46
VLAI
Title
btrfs: fix use-after-free when COWing tree bock and tracing is enabled
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free when COWing tree bock and tracing is enabled When a COWing a tree block, at btrfs_cow_block(), and we have the tracepoint trace_btrfs_cow_block() enabled and preemption is also enabled (CONFIG_PREEMPT=y), we can trigger a use-after-free in the COWed extent buffer while inside the tracepoint code. This is because in some paths that call btrfs_cow_block(), such as btrfs_search_slot(), we are holding the last reference on the extent buffer @buf so btrfs_force_cow_block() drops the last reference on the @buf extent buffer when it calls free_extent_buffer_stale(buf), which schedules the release of the extent buffer with RCU. This means that if we are on a kernel with preemption, the current task may be preempted before calling trace_btrfs_cow_block() and the extent buffer already released by the time trace_btrfs_cow_block() is called, resulting in a use-after-free. Fix this by moving the trace_btrfs_cow_block() from btrfs_cow_block() to btrfs_force_cow_block() before the COWed extent buffer is freed. This also has a side effect of invoking the tracepoint in the tree defrag code, at defrag.c:btrfs_realloc_node(), since btrfs_force_cow_block() is called there, but this is fine and it was actually missing there.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 3083ee2e18b701122a3b841db83448543a87a583 , < ba5120a2fb5f23b4d39d302e181aa5d4e28a90d1 (git)
Affected: 3083ee2e18b701122a3b841db83448543a87a583 , < 526ff5b27f090fb15040471f892cd2c9899ce314 (git)
Affected: 3083ee2e18b701122a3b841db83448543a87a583 , < 66376f1a73cba57fd0af2631d7888605b738e499 (git)
Affected: 3083ee2e18b701122a3b841db83448543a87a583 , < 9a466b8693b9add05de99af00c7bdff8259ecf19 (git)
Affected: 3083ee2e18b701122a3b841db83448543a87a583 , < c3a403d8ce36f5a809a492581de5ad17843e4701 (git)
Affected: 3083ee2e18b701122a3b841db83448543a87a583 , < 44f52bbe96dfdbe4aca3818a2534520082a07040 (git)
Create a notification for this product.
Linux Linux Affected: 3.4
Unaffected: 0 , < 3.4 (semver)
Unaffected: 5.10.233 , ≤ 5.10.* (semver)
Unaffected: 5.15.176 , ≤ 5.15.* (semver)
Unaffected: 6.1.124 , ≤ 6.1.* (semver)
Unaffected: 6.6.70 , ≤ 6.6.* (semver)
Unaffected: 6.12.8 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56759",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-11T15:41:24.236942Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-11T15:45:20.928Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T20:53:52.637Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/ctree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ba5120a2fb5f23b4d39d302e181aa5d4e28a90d1",
              "status": "affected",
              "version": "3083ee2e18b701122a3b841db83448543a87a583",
              "versionType": "git"
            },
            {
              "lessThan": "526ff5b27f090fb15040471f892cd2c9899ce314",
              "status": "affected",
              "version": "3083ee2e18b701122a3b841db83448543a87a583",
              "versionType": "git"
            },
            {
              "lessThan": "66376f1a73cba57fd0af2631d7888605b738e499",
              "status": "affected",
              "version": "3083ee2e18b701122a3b841db83448543a87a583",
              "versionType": "git"
            },
            {
              "lessThan": "9a466b8693b9add05de99af00c7bdff8259ecf19",
              "status": "affected",
              "version": "3083ee2e18b701122a3b841db83448543a87a583",
              "versionType": "git"
            },
            {
              "lessThan": "c3a403d8ce36f5a809a492581de5ad17843e4701",
              "status": "affected",
              "version": "3083ee2e18b701122a3b841db83448543a87a583",
              "versionType": "git"
            },
            {
              "lessThan": "44f52bbe96dfdbe4aca3818a2534520082a07040",
              "status": "affected",
              "version": "3083ee2e18b701122a3b841db83448543a87a583",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/ctree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.4"
            },
            {
              "lessThan": "3.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.233",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.124",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.70",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.233",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.176",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.124",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.70",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.8",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free when COWing tree bock and tracing is enabled\n\nWhen a COWing a tree block, at btrfs_cow_block(), and we have the\ntracepoint trace_btrfs_cow_block() enabled and preemption is also enabled\n(CONFIG_PREEMPT=y), we can trigger a use-after-free in the COWed extent\nbuffer while inside the tracepoint code. This is because in some paths\nthat call btrfs_cow_block(), such as btrfs_search_slot(), we are holding\nthe last reference on the extent buffer @buf so btrfs_force_cow_block()\ndrops the last reference on the @buf extent buffer when it calls\nfree_extent_buffer_stale(buf), which schedules the release of the extent\nbuffer with RCU. This means that if we are on a kernel with preemption,\nthe current task may be preempted before calling trace_btrfs_cow_block()\nand the extent buffer already released by the time trace_btrfs_cow_block()\nis called, resulting in a use-after-free.\n\nFix this by moving the trace_btrfs_cow_block() from btrfs_cow_block() to\nbtrfs_force_cow_block() before the COWed extent buffer is freed.\nThis also has a side effect of invoking the tracepoint in the tree defrag\ncode, at defrag.c:btrfs_realloc_node(), since btrfs_force_cow_block() is\ncalled there, but this is fine and it was actually missing there."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is btrfs\u0027s core b-tree COW path, reached through ordinary filesystem syscalls (write, create, unlink, rename) on a mounted btrfs volume. This requires local access to the system; there is no network protocol handler involved.\nAC:L - The attacker fully controls the triggering side \u2014 every metadata modification calls btrfs_search_slot() \u2192 btrfs_cow_block(), so the free-then-trace window can be retried millions of times, and the attacker can raise CPU/scheduling pressure with concurrent threads to make preemption at that point (and elapse of the RCU grace period) occur. A race the attacker can drive at will and retry unboundedly is Low complexity.\nPR:L - Only an unprivileged local account with write access to any btrfs filesystem is needed; no capability, CAP_SYS_ADMIN, or namespace check exists anywhere on the btrfs_search_slot() \u2192 btrfs_cow_block() path. Writing into a home directory or container rootfs on btrfs is sufficient.\nUI:N - The attacker triggers the COW path directly with its own filesystem operations; no victim action, mount, or file-open by another user is required.\nS:U - The use-after-free is confined to kernel memory managed by the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The freed extent_buffer is read after release from a mergeable, non-TYPESAFE_BY_RCU slab cache, and btrfs_header_level(buf) loads eb-\u003efolios[0] and dereferences it \u2014 with heap spray this becomes a controlled-address read whose result is emitted into the trace ring buffer, disclosing kernel memory.\nI:H - The use-after-free on a reclaimable, slab-mergeable object gives the attacker influence over the contents of the reused allocation and the pointer subsequently dereferenced, which is the standard primitive for escalating a UAF into kernel memory corruption and control-flow hijacking.\nA:H - Dereferencing the freed extent_buffer and its stale folios[0] pointer causes a wild-pointer access that oopses or panics the kernel (this is exactly what syzbot\u0027s KASAN report captured), and it can be re-triggered repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:46:23.511Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ba5120a2fb5f23b4d39d302e181aa5d4e28a90d1"
        },
        {
          "url": "https://git.kernel.org/stable/c/526ff5b27f090fb15040471f892cd2c9899ce314"
        },
        {
          "url": "https://git.kernel.org/stable/c/66376f1a73cba57fd0af2631d7888605b738e499"
        },
        {
          "url": "https://git.kernel.org/stable/c/9a466b8693b9add05de99af00c7bdff8259ecf19"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3a403d8ce36f5a809a492581de5ad17843e4701"
        },
        {
          "url": "https://git.kernel.org/stable/c/44f52bbe96dfdbe4aca3818a2534520082a07040"
        }
      ],
      "title": "btrfs: fix use-after-free when COWing tree bock and tracing is enabled",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56759",
    "datePublished": "2025-01-06T16:20:39.668Z",
    "dateReserved": "2024-12-29T11:26:39.761Z",
    "dateUpdated": "2026-08-05T11:46:23.511Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-56759",
      "date": "2026-08-06",
      "epss": "0.0022",
      "percentile": "0.12623"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.12.8\", \"matchCriteriaId\": \"37A8903F-DC48-45AD-98DC-188AFD7C5844\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"93C0660D-7FB8-4FBA-892A-B064BA71E49E\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix use-after-free when COWing tree bock and tracing is enabled\\n\\nWhen a COWing a tree block, at btrfs_cow_block(), and we have the\\ntracepoint trace_btrfs_cow_block() enabled and preemption is also enabled\\n(CONFIG_PREEMPT=y), we can trigger a use-after-free in the COWed extent\\nbuffer while inside the tracepoint code. This is because in some paths\\nthat call btrfs_cow_block(), such as btrfs_search_slot(), we are holding\\nthe last reference on the extent buffer @buf so btrfs_force_cow_block()\\ndrops the last reference on the @buf extent buffer when it calls\\nfree_extent_buffer_stale(buf), which schedules the release of the extent\\nbuffer with RCU. This means that if we are on a kernel with preemption,\\nthe current task may be preempted before calling trace_btrfs_cow_block()\\nand the extent buffer already released by the time trace_btrfs_cow_block()\\nis called, resulting in a use-after-free.\\n\\nFix this by moving the trace_btrfs_cow_block() from btrfs_cow_block() to\\nbtrfs_force_cow_block() before the COWed extent buffer is freed.\\nThis also has a side effect of invoking the tracepoint in the tree defrag\\ncode, at defrag.c:btrfs_realloc_node(), since btrfs_force_cow_block() is\\ncalled there, but this is fine and it was actually missing there.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: se corrige el use-after-free cuando se aplica COW a un bloque de \\u00e1rbol y se habilita el seguimiento Cuando se aplica COW a un bloque de \\u00e1rbol, en btrfs_cow_block(), y tenemos habilitado el punto de seguimiento trace_btrfs_cow_block() y tambi\\u00e9n est\\u00e1 habilitada la preempci\\u00f3n (CONFIG_PREEMPT=y), podemos activar un use-after-free en el b\\u00fafer de extensi\\u00f3n aplicado COW mientras estamos dentro del c\\u00f3digo del punto de seguimiento. Esto se debe a que en algunas rutas que llaman a btrfs_cow_block(), como btrfs_search_slot(), estamos manteniendo la \\u00faltima referencia en el b\\u00fafer de extensi\\u00f3n @buf, por lo que btrfs_force_cow_block() elimina la \\u00faltima referencia en el b\\u00fafer de extensi\\u00f3n @buf cuando llama a free_extent_buffer_stale(buf), que programa la liberaci\\u00f3n del b\\u00fafer de extensi\\u00f3n con RCU. Esto significa que si estamos en un n\\u00facleo con preempci\\u00f3n, la tarea actual puede ser preemptada antes de llamar a trace_btrfs_cow_block() y el buffer de extensi\\u00f3n ya liberado para el momento en que se llama a trace_btrfs_cow_block(), lo que da como resultado un use-after-free. Arregle esto moviendo trace_btrfs_cow_block() de btrfs_cow_block() a btrfs_force_cow_block() antes de que se libere el buffer de extensi\\u00f3n COWed. Esto tambi\\u00e9n tiene un efecto secundario de invocar el punto de seguimiento en el c\\u00f3digo de desfragmentaci\\u00f3n del \\u00e1rbol, en defrag.c:btrfs_realloc_node(), ya que btrfs_force_cow_block() se llama all\\u00ed, pero esto est\\u00e1 bien y en realidad faltaba all\\u00ed.\"}]",
      "id": "CVE-2024-56759",
      "lastModified": "2025-01-09T16:16:23.547",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2025-01-06T17:15:40.900",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/44f52bbe96dfdbe4aca3818a2534520082a07040\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/526ff5b27f090fb15040471f892cd2c9899ce314\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/66376f1a73cba57fd0af2631d7888605b738e499\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/9a466b8693b9add05de99af00c7bdff8259ecf19\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ba5120a2fb5f23b4d39d302e181aa5d4e28a90d1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c3a403d8ce36f5a809a492581de5ad17843e4701\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T01:20:20.000Z",
      "cve": "CVE-2024-56759",
      "id": "msrc_CVE-2024-56759",
      "initial_release_date": "2025-01-02T00:00:00.000Z",
      "product_status:known_not_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "btrfs: fix use-after-free when COWing tree bock and tracing is enabled",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-56759.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56759\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-06T17:15:40.900\",\"lastModified\":\"2026-06-17T08:12:55.563\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix use-after-free when COWing tree bock and tracing is enabled\\n\\nWhen a COWing a tree block, at btrfs_cow_block(), and we have the\\ntracepoint trace_btrfs_cow_block() enabled and preemption is also enabled\\n(CONFIG_PREEMPT=y), we can trigger a use-after-free in the COWed extent\\nbuffer while inside the tracepoint code. This is because in some paths\\nthat call btrfs_cow_block(), such as btrfs_search_slot(), we are holding\\nthe last reference on the extent buffer @buf so btrfs_force_cow_block()\\ndrops the last reference on the @buf extent buffer when it calls\\nfree_extent_buffer_stale(buf), which schedules the release of the extent\\nbuffer with RCU. This means that if we are on a kernel with preemption,\\nthe current task may be preempted before calling trace_btrfs_cow_block()\\nand the extent buffer already released by the time trace_btrfs_cow_block()\\nis called, resulting in a use-after-free.\\n\\nFix this by moving the trace_btrfs_cow_block() from btrfs_cow_block() to\\nbtrfs_force_cow_block() before the COWed extent buffer is freed.\\nThis also has a side effect of invoking the tracepoint in the tree defrag\\ncode, at defrag.c:btrfs_realloc_node(), since btrfs_force_cow_block() is\\ncalled there, but this is fine and it was actually missing there.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: se corrige el use-after-free cuando se aplica COW a un bloque de \u00e1rbol y se habilita el seguimiento Cuando se aplica COW a un bloque de \u00e1rbol, en btrfs_cow_block(), y tenemos habilitado el punto de seguimiento trace_btrfs_cow_block() y tambi\u00e9n est\u00e1 habilitada la preempci\u00f3n (CONFIG_PREEMPT=y), podemos activar un use-after-free en el b\u00fafer de extensi\u00f3n aplicado COW mientras estamos dentro del c\u00f3digo del punto de seguimiento. Esto se debe a que en algunas rutas que llaman a btrfs_cow_block(), como btrfs_search_slot(), estamos manteniendo la \u00faltima referencia en el b\u00fafer de extensi\u00f3n @buf, por lo que btrfs_force_cow_block() elimina la \u00faltima referencia en el b\u00fafer de extensi\u00f3n @buf cuando llama a free_extent_buffer_stale(buf), que programa la liberaci\u00f3n del b\u00fafer de extensi\u00f3n con RCU. Esto significa que si estamos en un n\u00facleo con preempci\u00f3n, la tarea actual puede ser preemptada antes de llamar a trace_btrfs_cow_block() y el buffer de extensi\u00f3n ya liberado para el momento en que se llama a trace_btrfs_cow_block(), lo que da como resultado un use-after-free. Arregle esto moviendo trace_btrfs_cow_block() de btrfs_cow_block() a btrfs_force_cow_block() antes de que se libere el buffer de extensi\u00f3n COWed. Esto tambi\u00e9n tiene un efecto secundario de invocar el punto de seguimiento en el c\u00f3digo de desfragmentaci\u00f3n del \u00e1rbol, en defrag.c:btrfs_realloc_node(), ya que btrfs_force_cow_block() se llama all\u00ed, pero esto est\u00e1 bien y en realidad faltaba all\u00ed.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/btrfs/ctree.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3083ee2e18b701122a3b841db83448543a87a583\",\"lessThan\":\"ba5120a2fb5f23b4d39d302e181aa5d4e28a90d1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3083ee2e18b701122a3b841db83448543a87a583\",\"lessThan\":\"526ff5b27f090fb15040471f892cd2c9899ce314\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3083ee2e18b701122a3b841db83448543a87a583\",\"lessThan\":\"66376f1a73cba57fd0af2631d7888605b738e499\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3083ee2e18b701122a3b841db83448543a87a583\",\"lessThan\":\"9a466b8693b9add05de99af00c7bdff8259ecf19\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3083ee2e18b701122a3b841db83448543a87a583\",\"lessThan\":\"c3a403d8ce36f5a809a492581de5ad17843e4701\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3083ee2e18b701122a3b841db83448543a87a583\",\"lessThan\":\"44f52bbe96dfdbe4aca3818a2534520082a07040\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/btrfs/ctree.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.233\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.176\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.124\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.70\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.8\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-11T15:41:24.236942Z\",\"id\":\"CVE-2024-56759\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.12.8\",\"matchCriteriaId\":\"37A8903F-DC48-45AD-98DC-188AFD7C5844\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"93C0660D-7FB8-4FBA-892A-B064BA71E49E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/44f52bbe96dfdbe4aca3818a2534520082a07040\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/526ff5b27f090fb15040471f892cd2c9899ce314\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/66376f1a73cba57fd0af2631d7888605b738e499\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9a466b8693b9add05de99af00c7bdff8259ecf19\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ba5120a2fb5f23b4d39d302e181aa5d4e28a90d1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c3a403d8ce36f5a809a492581de5ad17843e4701\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T11:25:06+00:00",
      "cve": "CVE-2024-56759",
      "id": "CVE-2024-56759",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: btrfs: fix use-after-free when COWing tree bock and tracing is enabled",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-56759.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-25T01:15:41Z",
      "cve": "CVE-2024-56759",
      "id": "CVE-2024-56759",
      "initial_release_date": "2025-01-07T03:48:59Z",
      "product_status:known_affected": "402",
      "product_status:known_not_affected": "91",
      "product_status:recommended": "731",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-56759",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-56759.json",
      "version": "73"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T20:53:52.637Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-56759\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-11T15:41:24.236942Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-11T15:41:25.683Z\"}}], \"cna\": {\"title\": \"btrfs: fix use-after-free when COWing tree bock and tracing is enabled\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is btrfs\u0027s core b-tree COW path, reached through ordinary filesystem syscalls (write, create, unlink, rename) on a mounted btrfs volume. This requires local access to the system; there is no network protocol handler involved.\\nAC:L - The attacker fully controls the triggering side \\u2014 every metadata modification calls btrfs_search_slot() \\u2192 btrfs_cow_block(), so the free-then-trace window can be retried millions of times, and the attacker can raise CPU/scheduling pressure with concurrent threads to make preemption at that point (and elapse of the RCU grace period) occur. A race the attacker can drive at will and retry unboundedly is Low complexity.\\nPR:L - Only an unprivileged local account with write access to any btrfs filesystem is needed; no capability, CAP_SYS_ADMIN, or namespace check exists anywhere on the btrfs_search_slot() \\u2192 btrfs_cow_block() path. Writing into a home directory or container rootfs on btrfs is sufficient.\\nUI:N - The attacker triggers the COW path directly with its own filesystem operations; no victim action, mount, or file-open by another user is required.\\nS:U - The use-after-free is confined to kernel memory managed by the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\\nC:H - The freed extent_buffer is read after release from a mergeable, non-TYPESAFE_BY_RCU slab cache, and btrfs_header_level(buf) loads eb-\u003efolios[0] and dereferences it \\u2014 with heap spray this becomes a controlled-address read whose result is emitted into the trace ring buffer, disclosing kernel memory.\\nI:H - The use-after-free on a reclaimable, slab-mergeable object gives the attacker influence over the contents of the reused allocation and the pointer subsequently dereferenced, which is the standard primitive for escalating a UAF into kernel memory corruption and control-flow hijacking.\\nA:H - Dereferencing the freed extent_buffer and its stale folios[0] pointer causes a wild-pointer access that oopses or panics the kernel (this is exactly what syzbot\u0027s KASAN report captured), and it can be re-triggered repeatedly.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3083ee2e18b701122a3b841db83448543a87a583\", \"lessThan\": \"ba5120a2fb5f23b4d39d302e181aa5d4e28a90d1\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3083ee2e18b701122a3b841db83448543a87a583\", \"lessThan\": \"526ff5b27f090fb15040471f892cd2c9899ce314\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3083ee2e18b701122a3b841db83448543a87a583\", \"lessThan\": \"66376f1a73cba57fd0af2631d7888605b738e499\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3083ee2e18b701122a3b841db83448543a87a583\", \"lessThan\": \"9a466b8693b9add05de99af00c7bdff8259ecf19\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3083ee2e18b701122a3b841db83448543a87a583\", \"lessThan\": \"c3a403d8ce36f5a809a492581de5ad17843e4701\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"3083ee2e18b701122a3b841db83448543a87a583\", \"lessThan\": \"44f52bbe96dfdbe4aca3818a2534520082a07040\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/btrfs/ctree.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"3.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.233\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.176\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.124\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.70\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/btrfs/ctree.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ba5120a2fb5f23b4d39d302e181aa5d4e28a90d1\"}, {\"url\": \"https://git.kernel.org/stable/c/526ff5b27f090fb15040471f892cd2c9899ce314\"}, {\"url\": \"https://git.kernel.org/stable/c/66376f1a73cba57fd0af2631d7888605b738e499\"}, {\"url\": \"https://git.kernel.org/stable/c/9a466b8693b9add05de99af00c7bdff8259ecf19\"}, {\"url\": \"https://git.kernel.org/stable/c/c3a403d8ce36f5a809a492581de5ad17843e4701\"}, {\"url\": \"https://git.kernel.org/stable/c/44f52bbe96dfdbe4aca3818a2534520082a07040\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix use-after-free when COWing tree bock and tracing is enabled\\n\\nWhen a COWing a tree block, at btrfs_cow_block(), and we have the\\ntracepoint trace_btrfs_cow_block() enabled and preemption is also enabled\\n(CONFIG_PREEMPT=y), we can trigger a use-after-free in the COWed extent\\nbuffer while inside the tracepoint code. This is because in some paths\\nthat call btrfs_cow_block(), such as btrfs_search_slot(), we are holding\\nthe last reference on the extent buffer @buf so btrfs_force_cow_block()\\ndrops the last reference on the @buf extent buffer when it calls\\nfree_extent_buffer_stale(buf), which schedules the release of the extent\\nbuffer with RCU. This means that if we are on a kernel with preemption,\\nthe current task may be preempted before calling trace_btrfs_cow_block()\\nand the extent buffer already released by the time trace_btrfs_cow_block()\\nis called, resulting in a use-after-free.\\n\\nFix this by moving the trace_btrfs_cow_block() from btrfs_cow_block() to\\nbtrfs_force_cow_block() before the COWed extent buffer is freed.\\nThis also has a side effect of invoking the tracepoint in the tree defrag\\ncode, at defrag.c:btrfs_realloc_node(), since btrfs_force_cow_block() is\\ncalled there, but this is fine and it was actually missing there.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.233\", \"versionStartIncluding\": \"3.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.176\", \"versionStartIncluding\": \"3.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.124\", \"versionStartIncluding\": \"3.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.70\", \"versionStartIncluding\": \"3.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.8\", \"versionStartIncluding\": \"3.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"3.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:46:23.511Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-56759\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:46:23.511Z\", \"dateReserved\": \"2024-12-29T11:26:39.761Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-01-06T16:20:39.668Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.