CVE-2024-49932 in Linux
Summary
by MITRE • 10/21/2024
In the Linux kernel, the following vulnerability has been resolved:
btrfs: don't readahead the relocation inode on RST
On relocation we're doing readahead on the relocation inode, but if the filesystem is backed by a RAID stripe tree we can get ENOENT (e.g. due to preallocated extents not being mapped in the RST) from the lookup.
But readahead doesn't handle the error and submits invalid reads to the device, causing an assertion in the scatter-gather list code:
BTRFS info (device nvme1n1): balance: start -d -m -s BTRFS info (device nvme1n1): relocating block group 6480920576 flags data|raid0 BTRFS error (device nvme1n1): cannot find raid-stripe for logical [6481928192, 6481969152] devid 2, profile raid0
------------[ cut here ]------------
kernel BUG at include/linux/scatterlist.h:115! Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI
CPU: 0 PID: 1012 Comm: btrfs Not tainted 6.10.0-rc7+ #567 RIP: 0010:__blk_rq_map_sg+0x339/0x4a0 RSP: 0018:ffffc90001a43820 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802 RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000 RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8 R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000 FS: 00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002cd11000 CR3: 00000001109ea001 CR4: 0000000000370eb0 Call Trace: ? __die_body.cold+0x14/0x25 ? die+0x2e/0x50 ? do_trap+0xca/0x110 ? do_error_trap+0x65/0x80 ? __blk_rq_map_sg+0x339/0x4a0 ? exc_invalid_op+0x50/0x70 ? __blk_rq_map_sg+0x339/0x4a0 ? asm_exc_invalid_op+0x1a/0x20 ? __blk_rq_map_sg+0x339/0x4a0 nvme_prep_rq.part.0+0x9d/0x770 nvme_queue_rq+0x7d/0x1e0 __blk_mq_issue_directly+0x2a/0x90 ? blk_mq_get_budget_and_tag+0x61/0x90 blk_mq_try_issue_list_directly+0x56/0xf0 blk_mq_flush_plug_list.part.0+0x52b/0x5d0 __blk_flush_plug+0xc6/0x110 blk_finish_plug+0x28/0x40 read_pages+0x160/0x1c0 page_cache_ra_unbounded+0x109/0x180 relocate_file_extent_cluster+0x611/0x6a0 ? btrfs_search_slot+0xba4/0xd20 ? balance_dirty_pages_ratelimited_flags+0x26/0xb00 relocate_data_extent.constprop.0+0x134/0x160 relocate_block_group+0x3f2/0x500 btrfs_relocate_block_group+0x250/0x430 btrfs_relocate_chunk+0x3f/0x130 btrfs_balance+0x71b/0xef0 ? kmalloc_trace_noprof+0x13b/0x280 btrfs_ioctl+0x2c2e/0x3030 ? kvfree_call_rcu+0x1e6/0x340 ? list_lru_add_obj+0x66/0x80 ? mntput_no_expire+0x3a/0x220 __x64_sys_ioctl+0x96/0xc0 do_syscall_64+0x54/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fcc04514f9b Code: Unable to access opcode bytes at 0x7fcc04514f71. RSP: 002b:00007ffeba923370 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fcc04514f9b RDX: 00007ffeba923460 RSI: 00000000c4009420 RDI: 0000000000000003 RBP: 0000000000000000 R08: 0000000000000013 R09: 0000000000000001 R10: 00007fcc043fbba8 R11: 0000000000000246 R12: 00007ffeba924fc5 R13: 00007ffeba923460 R14: 0000000000000002 R15: 00000000004d4bb0 Modules linked in: ---[ end trace 0000000000000000 ]---
RIP: 0010:__blk_rq_map_sg+0x339/0x4a0 RSP: 0018:ffffc90001a43820 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffea00045d4802 RDX: 0000000117520000 RSI: 0000000000000000 RDI: ffff8881027d1000 RBP: 0000000000003000 R08: ffffea00045d4902 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000001000 R12: ffff8881003d10b8 R13: ffffc90001a438f0 R14: 0000000000000000 R15: 0000000000003000 FS: 00007fcc048a6900(0000) GS:ffff88813bc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fcc04514f71 CR3: 00000001109ea001 CR4: 0000000000370eb0 Kernel p ---truncated---
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 03/17/2026
The vulnerability described in CVE-2024-49932 affects the Linux kernel's btrfs filesystem implementation, specifically during the relocation process of data blocks. This issue arises when the filesystem is configured with RAID stripe trees, which are used to distribute data across multiple storage devices for redundancy and performance. The flaw occurs when the system attempts to perform readahead operations on the relocation inode, which is a metadata structure used during block relocation tasks. During this process, the system encounters an ENOENT error, indicating that a requested resource cannot be found, typically due to preallocated extents not being properly mapped within the RAID stripe tree. This error occurs during lookup operations that are part of the block relocation mechanism, where the system fails to properly handle the error condition.
The technical root cause of this vulnerability lies in the improper error handling within the readahead subsystem of btrfs. When the system attempts to read ahead data for relocation, it does not correctly process the error returned by the lookup operation that fails to find the required RAID stripe mapping. This leads to invalid read operations being submitted to the storage device, which triggers a kernel assertion in the scatter-gather list code. The assertion failure occurs at include/linux/scatterlist.h:115 within the __blk_rq_map_sg function, which is responsible for mapping block requests to scatter-gather lists for I/O operations. The kernel crashes with a kernel BUG, indicating an invalid opcode execution, which represents a critical failure in the storage subsystem's handling of invalid I/O requests.
The operational impact of this vulnerability is severe, as it can cause complete system crashes or kernel panics when btrfs filesystems with RAID configurations undergo block relocation operations. This typically happens during balance operations, which are used to redistribute data blocks across storage devices to maintain optimal performance and redundancy levels. The vulnerability affects systems running kernel versions that include the problematic btrfs implementation, particularly those using RAID0 or other striped RAID configurations. The crash occurs during legitimate filesystem maintenance operations, meaning that even routine system administration tasks can trigger the vulnerability, potentially leading to data loss or system downtime. The error path shows that this vulnerability can be triggered through ioctl operations, which are commonly used by system administrators and automated tools to manage filesystem balance and relocation.
The fix for this vulnerability involves modifying the btrfs implementation to properly handle the error conditions that occur during readahead operations on relocation inodes. The solution requires ensuring that when lookups fail and return ENOENT errors, the system does not proceed to submit invalid read requests to the storage subsystem. This aligns with CWE-252, which addresses "Unchecked Return Value" conditions where functions that may fail are not properly checked for error status. The fix should implement proper error checking and handling mechanisms that prevent invalid operations from being submitted to the storage layer, thus avoiding the kernel assertion failure. From an ATT&CK perspective, this vulnerability represents a privilege escalation vector through kernel exploitation, as it allows for system crashes that can be leveraged in denial-of-service attacks against critical systems. The vulnerability also relates to T1490, which covers Data Destruction, as system crashes during filesystem operations can lead to data corruption or loss, particularly when the system is unable to properly complete relocation processes. Mitigation strategies include applying the kernel patch that resolves the improper error handling, ensuring that all systems running btrfs with RAID configurations are updated to versions that include the fix, and monitoring for unusual filesystem balance operations that might trigger the vulnerability.