{
  "cveId": "CVE-2024-44972",
  "url": "https://patchblox.com/security/cve/CVE-2024-44972",
  "summary": "CVE-2024-44972 is fixed in 5 products on 1 platform, first by DEBIAN-CVE-2024-44972, released September 4, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  btrfs: do not clear page dirty inside extent_wri...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  btrfs: do not clear page dirty inside extent_write_locked_range()  [BUG] For subpage \u002B zoned case, the following workload can lead to rsv data leak at unmount time:    # mkfs.btrfs -f -s 4k $dev   # mount $dev $mnt   # fsstress -w -n 8 -d $mnt -s 1709539240   0/0: fiemap - no filename   0/1: copyrange read - no filename   0/2: write - no filename   0/3: rename - no source filename   0/4: creat f0 x:0 0 0   0/4: creat add id=0,parent=-1   0/5: writev f0[259 1 0 0 0 0] [778052,113,965] 0   0/6: ioctl(FIEMAP) f0[259 1 0 0 224 887097] [1294220,2291618343991484791,0x10000] -1   0/7: dwrite - xfsctl(XFS_IOC_DIOINFO) f0[259 1 0 0 224 887097] return 25, fallback to stat()   0/7: dwrite f0[259 1 0 0 224 887097] [696320,102400] 0   # umount $mnt  The dmesg includes the following rsv leak detection warning (all call trace skipped):    ------------[ cut here ]------------   WARNING: CPU: 2 PID: 4528 at fs/btrfs/inode.c:8653 btrfs_destroy_inode\u002B0x1e0/0x200 [btrfs]   ---[ end trace 0000000000000000 ]---   ------------[ cut here ]------------   WARNING: CPU: 2 PID: 4528 at fs/btrfs/inode.c:8654 btrfs_destroy_inode\u002B0x1a8/0x200 [btrfs]   ---[ end trace 0000000000000000 ]---   ------------[ cut here ]------------   WARNING: CPU: 2 PID: 4528 at fs/btrfs/inode.c:8660 btrfs_destroy_inode\u002B0x1a0/0x200 [btrfs]   ---[ end trace 0000000000000000 ]---   BTRFS info (device sda): last unmount of filesystem 1b4abba9-de34-4f07-9e7f-157cf12a18d6   ------------[ cut here ]------------   WARNING: CPU: 3 PID: 4528 at fs/btrfs/block-group.c:4434 btrfs_free_block_groups\u002B0x338/0x500 [btrfs]   ---[ end trace 0000000000000000 ]---   BTRFS info (device sda): space_info DATA has 268218368 free, is not full   BTRFS info (device sda): space_info total=268435456, used=204800, pinned=0, reserved=0, may_use=12288, readonly=0 zone_unusable=0   BTRFS info (device sda): global_block_rsv: size 0 reserved 0   BTRFS info (device sda): trans_block_rsv: size 0 reserved 0   BTRFS info (device sda): chunk_block_rsv: size 0 reserved 0   BTRFS info (device sda): delayed_block_rsv: size 0 reserved 0   BTRFS info (device sda): delayed_refs_rsv: size 0 reserved 0   ------------[ cut here ]------------   WARNING: CPU: 3 PID: 4528 at fs/btrfs/block-group.c:4434 btrfs_free_block_groups\u002B0x338/0x500 [btrfs]   ---[ end trace 0000000000000000 ]---   BTRFS info (device sda): space_info METADATA has 267796480 free, is not full   BTRFS info (device sda): space_info total=268435456, used=131072, pinned=0, reserved=0, may_use=262144, readonly=0 zone_unusable=245760   BTRFS info (device sda): global_block_rsv: size 0 reserved 0   BTRFS info (device sda): trans_block_rsv: size 0 reserved 0   BTRFS info (device sda): chunk_block_rsv: size 0 reserved 0   BTRFS info (device sda): delayed_block_rsv: size 0 reserved 0   BTRFS info (device sda): delayed_refs_rsv: size 0 reserved 0  Above $dev is a tcmu-runner emulated zoned HDD, which has a max zone append size of 64K, and the system has 64K page size.  [CAUSE] I have added several trace_printk() to show the events (header skipped):    \u003E btrfs_dirty_pages: r/i=5/259 dirty start=774144 len=114688   \u003E btrfs_dirty_pages: r/i=5/259 dirty part of page=720896 off_in_page=53248 len_in_page=12288   \u003E btrfs_dirty_pages: r/i=5/259 dirty part of page=786432 off_in_page=0 len_in_page=65536   \u003E btrfs_dirty_pages: r/i=5/259 dirty part of page=851968 off_in_page=0 len_in_page=36864  The above lines show our buffered write has dirtied 3 pages of inode 259 of root 5:    704K             768K              832K              896K   I           |////I/////////////////I///////////|     I               756K                               868K    |///| is the dirtied range using subpage bitmaps. and \u0027I\u0027 is the page   boundary.    Meanwhile all three pages (704K, 768K, 832K) have their PageDirty   flag set.    \u003E btrfs_direct_write: r/i=5/259 start dio filepos=696320 len=102400  Then direct IO writ ---truncated---",
  "published": "2024-09-04T19:15:31Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "kernel-coco",
      "release": "sles 15.6",
      "fixedVersion": "6.4.0-15061.6.coco15sp6.1",
      "fix": "SUSE-SU-2024:3553-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-3553-1",
      "released": "2024-10-08T15:10:23Z"
    },
    {
      "platform": "linux",
      "product": "kernel-coco_debug",
      "release": "sles 15.6",
      "fixedVersion": "6.4.0-15061.6.coco15sp6.1",
      "fix": "SUSE-SU-2024:3553-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-3553-1",
      "released": "2024-10-08T15:10:23Z"
    },
    {
      "platform": "linux",
      "product": "kernel-source-coco",
      "release": "sles 15.6",
      "fixedVersion": "6.4.0-15061.6.coco15sp6.1",
      "fix": "SUSE-SU-2024:3553-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-3553-1",
      "released": "2024-10-08T15:10:23Z"
    },
    {
      "platform": "linux",
      "product": "kernel-syms-coco",
      "release": "sles 15.6",
      "fixedVersion": "6.4.0-15061.6.coco15sp6.1",
      "fix": "SUSE-SU-2024:3553-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2024-3553-1",
      "released": "2024-10-08T15:10:23Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.10.6-1",
      "fix": "DEBIAN-CVE-2024-44972",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-44972",
      "released": "2024-09-04T19:15:31Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "6.10.6-1",
      "fix": "DEBIAN-CVE-2024-44972",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-44972",
      "released": "2024-09-04T19:15:31Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}