# CVE-2024-26644: linux: In the Linux kernel, the following vulnerability has been resolved: btrfs: don't abort filesystem when attempting to... CVE-2024-26644 is fixed in 30 products on 1 platform, first by ALAS2023-2024-517, released February 15, 2024. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2024-26644 - Priority: Routine - CVSS: 5.5 (medium) - EPSS: 0.0023 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Feb 15, 2024 ## Description In the Linux kernel, the following vulnerability has been resolved: btrfs: don't abort filesystem when attempting to snapshot deleted subvolume If the source file descriptor to the snapshot ioctl refers to a deleted subvolume, we get the following abort: BTRFS: Transaction aborted (error -2) WARNING: CPU: 0 PID: 833 at fs/btrfs/transaction.c:1875 create_pending_snapshot+0x1040/0x1190 [btrfs] Modules linked in: pata_acpi btrfs ata_piix libata scsi_mod virtio_net blake2b_generic xor net_failover virtio_rng failover scsi_common rng_core raid6_pq libcrc32c CPU: 0 PID: 833 Comm: t_snapshot_dele Not tainted 6.7.0-rc6 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014 RIP: 0010:create_pending_snapshot+0x1040/0x1190 [btrfs] RSP: 0018:ffffa09c01337af8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff9982053e7c78 RCX: 0000000000000027 RDX: ffff99827dc20848 RSI: 0000000000000001 RDI: ffff99827dc20840 RBP: ffffa09c01337c00 R08: 0000000000000000 R09: ffffa09c01337998 R10: 0000000000000003 R11: ffffffffb96da248 R12: fffffffffffffffe R13: ffff99820535bb28 R14: ffff99820b7bd000 R15: ffff99820381ea80 FS: 00007fe20aadabc0(0000) GS:ffff99827dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000559a120b502f CR3: 00000000055b6000 CR4: 00000000000006f0 Call Trace: ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? __warn+0x81/0x130 ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? report_bug+0x171/0x1a0 ? handle_bug+0x3a/0x70 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? create_pending_snapshot+0x1040/0x1190 [btrfs] create_pending_snapshots+0x92/0xc0 [btrfs] btrfs_commit_transaction+0x66b/0xf40 [btrfs] btrfs_mksubvol+0x301/0x4d0 [btrfs] btrfs_mksnapshot+0x80/0xb0 [btrfs] __btrfs_ioctl_snap_create+0x1c2/0x1d0 [btrfs] btrfs_ioctl_snap_create_v2+0xc4/0x150 [btrfs] btrfs_ioctl+0x8a6/0x2650 [btrfs] ? kmem_cache_free+0x22/0x340 ? do_sys_openat2+0x97/0xe0 __x64_sys_ioctl+0x97/0xd0 do_syscall_64+0x46/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 RIP: 0033:0x7fe20abe83af RSP: 002b:00007ffe6eff1360 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007fe20abe83af RDX: 00007ffe6eff23c0 RSI: 0000000050009417 RDI: 0000000000000003 RBP: 0000000000000003 R08: 0000000000000000 R09: 00007fe20ad16cd0 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe6eff13c0 R14: 00007fe20ad45000 R15: 0000559a120b6d58 ---[ end trace 0000000000000000 ]--- BTRFS: error (device vdc: state A) in create_pending_snapshot:1875: errno=-2 No such entry BTRFS info (device vdc: state EA): forced readonly BTRFS warning (device vdc: state EA): Skipping commit of aborted transaction. BTRFS: error (device vdc: state EA) in cleanup_transaction:2055: errno=-2 No such entry This happens because create_pending_snapshot() initializes the new root item as a copy of the source root item. This includes the refs field, which is 0 for a deleted subvolume. The call to btrfs_insert_root() therefore inserts a root with refs == 0. btrfs_get_new_fs_root() then finds the root and returns -ENOENT if refs == 0, which causes create_pending_snapshot() to abort. Fix it by checking the source root's refs before attempting the snapshot, but after locking subvol_sem to avoid racing with deletion. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | bpftool amzn 2023 | 6.1.77-99.164.amzn2023 | [ALAS2023-2024-517](https://patchblox.com/security/data/fix/linux/alas2023-2024-517.md) | Feb 15, 2024 | | Linux | bpftool-debuginfo amzn 2023 | 6.1.77-99.164.amzn2023 | [ALAS2023-2024-517](https://patchblox.com/security/data/fix/linux/alas2023-2024-517.md) | Feb 15, 2024 | | Linux | kernel amzn 2023 | 6.1.77-99.164.amzn2023 | [ALAS2023-2024-517](https://patchblox.com/security/data/fix/linux/alas2023-2024-517.md) | Feb 15, 2024 | | Linux | kernel-debuginfo amzn 2023 | 6.1.77-99.164.amzn2023 | [ALAS2023-2024-517](https://patchblox.com/security/data/fix/linux/alas2023-2024-517.md) | Feb 15, 2024 | | Linux | kernel-debuginfo-common-aarch64 amzn 2023 | 6.1.77-99.164.amzn2023 | [ALAS2023-2024-517](https://patchblox.com/security/data/fix/linux/alas2023-2024-517.md) | Feb 15, 2024 | | Linux | kernel-debuginfo-common-x86_64 amzn 2023 | 6.1.77-99.164.amzn2023 | [ALAS2023-2024-517](https://patchblox.com/security/data/fix/linux/alas2023-2024-517.md) | Feb 15, 2024 | | Linux | kernel-devel amzn 2023 | 6.1.77-99.164.amzn2023 | [ALAS2023-2024-517](https://patchblox.com/security/data/fix/linux/alas2023-2024-517.md) | Feb 15, 2024 | | Linux | kernel-headers amzn 2023 | 6.1.77-99.164.amzn2023 | [ALAS2023-2024-517](https://patchblox.com/security/data/fix/linux/alas2023-2024-517.md) | Feb 15, 2024 | | Linux | kernel-libbpf amzn 2023 | 6.1.77-99.164.amzn2023 | [ALAS2023-2024-517](https://patchblox.com/security/data/fix/linux/alas2023-2024-517.md) | Feb 15, 2024 | | Linux | kernel-libbpf-devel amzn 2023 | 6.1.77-99.164.amzn2023 | [ALAS2023-2024-517](https://patchblox.com/security/data/fix/linux/alas2023-2024-517.md) | Feb 15, 2024 | | Linux | kernel-libbpf-static amzn 2023 | 6.1.77-99.164.amzn2023 | [ALAS2023-2024-517](https://patchblox.com/security/data/fix/linux/alas2023-2024-517.md) | Feb 15, 2024 | | Linux | kernel-livepatch-6.1.77-99.164 amzn 2023 | 1.0-0.amzn2023 | [ALAS2023-2024-517](https://patchblox.com/security/data/fix/linux/alas2023-2024-517.md) | Feb 15, 2024 | | Linux | kernel-modules-extra amzn 2023 | 6.1.77-99.164.amzn2023 | [ALAS2023-2024-517](https://patchblox.com/security/data/fix/linux/alas2023-2024-517.md) | Feb 15, 2024 | | Linux | kernel-modules-extra-common amzn 2023 | 6.1.77-99.164.amzn2023 | [ALAS2023-2024-517](https://patchblox.com/security/data/fix/linux/alas2023-2024-517.md) | Feb 15, 2024 | | Linux | kernel-tools amzn 2023 | 6.1.77-99.164.amzn2023 | [ALAS2023-2024-517](https://patchblox.com/security/data/fix/linux/alas2023-2024-517.md) | Feb 15, 2024 | | Linux | kernel-tools-debuginfo amzn 2023 | 6.1.77-99.164.amzn2023 | [ALAS2023-2024-517](https://patchblox.com/security/data/fix/linux/alas2023-2024-517.md) | Feb 15, 2024 | | Linux | kernel-tools-devel amzn 2023 | 6.1.77-99.164.amzn2023 | [ALAS2023-2024-517](https://patchblox.com/security/data/fix/linux/alas2023-2024-517.md) | Feb 15, 2024 | | Linux | kernel-uek ol 8 | 0:5.4.17-2136.348.3.el7uek | [ELSA-2025-20663](https://patchblox.com/security/data/fix/linux/elsa-2025-20663.md) | Oct 11, 2025 | | Linux | kernel-uek-container ol 8 | 0:5.4.17-2136.348.3.el7uek | [ELSA-2025-20663](https://patchblox.com/security/data/fix/linux/elsa-2025-20663.md) | Oct 11, 2025 | | Linux | kernel-uek-container-debug ol 8 | 0:5.4.17-2136.348.3.el7uek | [ELSA-2025-20663](https://patchblox.com/security/data/fix/linux/elsa-2025-20663.md) | Oct 11, 2025 | | Linux | kernel-uek-debug ol 8 | 0:5.4.17-2136.348.3.el7uek | [ELSA-2025-20663](https://patchblox.com/security/data/fix/linux/elsa-2025-20663.md) | Oct 11, 2025 | | Linux | kernel-uek-debug-devel ol 8 | 0:5.4.17-2136.348.3.el7uek | [ELSA-2025-20663](https://patchblox.com/security/data/fix/linux/elsa-2025-20663.md) | Oct 11, 2025 | | Linux | kernel-uek-devel ol 8 | 0:5.4.17-2136.348.3.el7uek | [ELSA-2025-20663](https://patchblox.com/security/data/fix/linux/elsa-2025-20663.md) | Oct 11, 2025 | | Linux | kernel-uek-doc ol 8 | 0:5.4.17-2136.348.3.el7uek | [ELSA-2025-20663](https://patchblox.com/security/data/fix/linux/elsa-2025-20663.md) | Oct 11, 2025 | | Linux | kernel-uek-tools ol 8 | 0:5.4.17-2136.348.3.el7uek | [ELSA-2025-20663](https://patchblox.com/security/data/fix/linux/elsa-2025-20663.md) | Oct 11, 2025 | | Linux | linux Debian 12.15 (bookworm) | 6.1.76-1 | [DEBIAN-CVE-2024-26644](https://patchblox.com/security/data/fix/linux/debian-cve-2024-26644.md) | Mar 26, 2024 | | Linux | linux Debian 13.5 (trixie) | 6.6.15-1 | [DEBIAN-CVE-2024-26644](https://patchblox.com/security/data/fix/linux/debian-cve-2024-26644.md) | Mar 26, 2024 | | Linux | linux Debian 14 | 6.6.15-1 | [DEBIAN-CVE-2024-26644](https://patchblox.com/security/data/fix/linux/debian-cve-2024-26644.md) | Mar 26, 2024 | | Linux | perf amzn 2023 | 6.1.77-99.164.amzn2023 | [ALAS2023-2024-517](https://patchblox.com/security/data/fix/linux/alas2023-2024-517.md) | Feb 15, 2024 | | Linux | perf-debuginfo amzn 2023 | 6.1.77-99.164.amzn2023 | [ALAS2023-2024-517](https://patchblox.com/security/data/fix/linux/alas2023-2024-517.md) | Feb 15, 2024 | | Linux | python3-perf amzn 2023 | 6.1.77-99.164.amzn2023 | [ALAS2023-2024-517](https://patchblox.com/security/data/fix/linux/alas2023-2024-517.md) | Feb 15, 2024 | | Linux | python3-perf-debuginfo amzn 2023 | 6.1.77-99.164.amzn2023 | [ALAS2023-2024-517](https://patchblox.com/security/data/fix/linux/alas2023-2024-517.md) | Feb 15, 2024 | --- Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.