# CVE-2024-35798: linux: In the Linux kernel, the following vulnerability has been resolved:  btrfs: fix race in read_extent_buffer_pages()  T...

CVE-2024-35798 is fixed in linux on 1 platform, first by DEBIAN-CVE-2024-35798, released May 17, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2024-35798
- Priority: Routine
- CVSS: 4.7 (medium)
- EPSS: 0.0018
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 17, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  btrfs: fix race in read_extent_buffer_pages()  There are reports from tree-checker that detects corrupted nodes, without any obvious pattern so possibly an overwrite in memory. After some debugging it turns out there's a race when reading an extent buffer the uptodate status can be missed.  To prevent concurrent reads for the same extent buffer, read_extent_buffer_pages() performs these checks:      /* (1) */     if (test_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags))         return 0;      /* (2) */     if (test_and_set_bit(EXTENT_BUFFER_READING, &eb->bflags))         goto done;  At this point, it seems safe to start the actual read operation. Once that completes, end_bbio_meta_read() does      /* (3) */     set_extent_buffer_uptodate(eb);      /* (4) */     clear_bit(EXTENT_BUFFER_READING, &eb->bflags);  Normally, this is enough to ensure only one read happens, and all other callers wait for it to finish before returning.  Unfortunately, there is a racey interleaving:      Thread A | Thread B | Thread C     ---------+----------+---------        (1)   |          |              |    (1)   |        (2)   |          |        (3)   |          |        (4)   |          |              |    (2)   |              |          |    (1)  When this happens, thread B kicks of an unnecessary read. Worse, thread C will see UPTODATE set and return immediately, while the read from thread B is still in progress.  This race could result in tree-checker errors like this as the extent buffer is concurrently modified:      BTRFS critical (device dm-0): corrupted node, root=256     block=8550954455682405139 owner mismatch, have 11858205567642294356     expect [256, 18446744073709551360]  Fix it by testing UPTODATE again after setting the READING bit, and if it's been set, skip the unnecessary read.  [ minor update of changelog ]

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.7.12-1 | [DEBIAN-CVE-2024-35798](https://patchblox.com/security/data/fix/linux/debian-cve-2024-35798.md) | May 17, 2024 |
| Linux | linux Debian 14 | 6.7.12-1 | [DEBIAN-CVE-2024-35798](https://patchblox.com/security/data/fix/linux/debian-cve-2024-35798.md) | May 17, 2024 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.