CVE-2024-26792

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix double free of anonymous device after snapshot creation failure

When creating a snapshot we may do a double free of an anonymous device

in case there's an error committing the transaction. The second free may

result in freeing an anonymous device number that was allocated by some

other subsystem in the kernel or another btrfs filesystem.

The steps that lead to this:

1) At ioctl.c:create_snapshot() we allocate an anonymous device number

and assign it to pending_snapshot->anon_dev;

2) Then we call btrfs_commit_transaction() and end up at

transaction.c:create_pending_snapshot();

3) There we call btrfs_get_new_fs_root() and pass it the anonymous device

number stored in pending_snapshot->anon_dev;

4) btrfs_get_new_fs_root() frees that anonymous device number because

btrfs_lookup_fs_root() returned a root - someone else did a lookup

of the new root already, which could some task doing backref

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References