What’s Vulnerable › Vulnerabilities

CVE-2024-42314: btrfs: fix extent map use-after-free when adding pages to compressed bio

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-08-17 · updated 2026-08-04
• Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix extent map use-after-free when adding pages to compressed bio At add_ra_bio_pages() we are accessing the extent map to calculate 'add_size' after we dropped our reference on the extent map, resulting in a use-after-free. Fix this by computing 'add_size' before dropping our extent map reference.

Affected products

• Debian Linux: 11.0
• Linux kernel: from 5.16 before 6.1.108; from 6.2 before 6.6.44; from 6.7 before 6.10.3 — fixed in 6.1.108, 6.10.3, 6.6.44

How to fix

Upgrade to a fixed version: Linux kernel 6.1.108, 6.10.3, 6.6.44. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/8e7860543a94784d744c7ce34b78a2e11beefa5c
• https://git.kernel.org/stable/c/b7859ff398b6b656e1689daa860eb34837b4bb89
• https://git.kernel.org/stable/c/c1cc3326e27b0bd7a2806b40bc48e49afaf951e7
• https://git.kernel.org/stable/c/c205565e0f2f439f278a4a94ee97b67ef7b56ae8
• https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html

Get alerted when CVE-2024-42314 or the next vulnerability affects your stack