CVE-2021-4149

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-03-23 · updated 2026-06-17
Weakness: CWE-667

Description

A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of service (DOS) due to a deadlock problem.

Affected products

Debian Linux: 9.0
Linux kernel: before 5.15; 5.15, 5.15-rc1, 5.15-rc2, 5.15-rc3, 5.15-rc4, 5.15-rc5 — fixed in 5.15

How to fix

Upgrade to a fixed version: Linux kernel 5.15. Check the vendor advisory for mitigations.

References

https://bugzilla.redhat.com/show_bug.cgi?id=2026485
https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
https://lkml.org/lkml/2021/10/18/885
https://lkml.org/lkml/2021/9/13/2565
https://bugzilla.redhat.com/show_bug.cgi?id=2026485
https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html
https://lkml.org/lkml/2021/10/18/885
https://lkml.org/lkml/2021/9/13/2565

Get alerted when CVE-2021-4149 or the next vulnerability affects your stack