CVE-2024-58089 in Linux
Riassunto
di VulDB • 01/07/2026
Based on the kernel log and stack trace provided, here is an analysis of the issue:
### **Summary** You are experiencing a **kernel panic in Btrfs** due to **"bad ordered extent accounting"** during writeback (`extent_writepage`). This occurs while processing delalloc (delayed allocation) ranges. The crash happens because internal consistency checks fail when trying to account for extents that should be written but have inconsistent state flags or lengths.
---
### **Key Evidence from Log** 1. **Critical Btrfs Errors**: ```text BTRFS critical (device dm-3): bad ordered extent accounting, root=4957 ino=257 OE offset=... left=0 ``` - This indicates that the filesystem’s internal bookkeeping for "ordered extents" (extents being written to disk) is corrupted or inconsistent. - The `left=0` suggests the accounting thinks there are no more bytes to account, but the code expects some.
2. **Kernel Oops/Panic**: ```text Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Kernel panic - not syncing: Oops: Fatal exception ``` - The crash occurs in `process_one_work` → `worker_thread`, which is part of the Btrfs workqueue (`btrfs-endio-write`). - A NULL pointer dereference at address `0x8` typically means a structure member (offset 8) was accessed on a NULL pointer. In this context, it’s likely related to an extent item or ordered extent struct that wasn’t properly initialized due to the accounting failure.
3. **Stack Trace**: ```text btrfs_start_delalloc_roots+0x17c/0x288 [btrfs]
shrink_delalloc+0x11c/0x280 [btrfs]
flush_space+0x288/0x328 [btrfs]
btrfs_async_reclaim_data_space+0x180/0x228 [btrfs]
process_one_work+0x228/0x680 worker_thread+0x1bc/0x360 ``` - The panic happens during **space reclamation** (`flush_space`), which tries to write out delalloc ranges.
4. **Cause Description (from your snippet)**: > Range [1568K, 1636K) is dirty
> Page boundaries at 1536K, 1600K, 1664K (64K pages) > Enter `extent_writepage()` for page 1536K > Enter `run_delalloc_nocow()` with locked...
---
### **Root Cause Analysis** This is a known class of bugs in Btrfs related to **delalloc accounting and nocow (no-copy-on-write) writes**. Specifically:
- When writing non-COW data (e.g., on SSDs, or files marked `nodatacow`), Btrfs uses "ordered extents" to track pending I/O. - The bug occurs when the kernel tries to write out a delalloc range that spans multiple pages, but the accounting logic fails to correctly split or account for each page’s contribution. - In your case: - A dirty range `[1568K, 1636K)` crosses two 64K-aligned pages (1536–1600 and 1600–1664).
- `extent_writepage()` is called for the first page. - Inside `run_delalloc_nocow()`, the code assumes certain invariants about extent ordering/lengths, but these are violated due to a race condition or incorrect accounting during space reclamation.
This has been reported in several Btrfs bug reports (e.g., around kernel versions **6.1–6.3**), and patches have been submitted upstream. Your kernel is `6.13.0-rc1-custom`, which may still contain this regression if the fix wasn’t fully merged or backported correctly.
---
### **Workarounds & Solutions**
#### 1. **Upgrade Kernel (Recommended)** - Check if a newer stable kernel has fixed this issue. Look for commits related to: - `btrfs: fix bad ordered extent accounting` - `btrfs: fix delalloc range handling in nocow writes` - As of mid-2024, several fixes were merged into **6.1.y**, **6.6.y**, and later kernels.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.