# CVE-2024-44972: linux: In the Linux kernel, the following vulnerability has been resolved:  btrfs: do not clear page dirty inside extent_wri...

CVE-2024-44972 is fixed in 5 products on 1 platform, first by DEBIAN-CVE-2024-44972, released September 4, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2024-44972
- Priority: Routine
- CVSS: 5.5 (medium)
- EPSS: n/a
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 4, 2024

## Description

In the Linux kernel, the following vulnerability has been resolved:  btrfs: do not clear page dirty inside extent_write_locked_range()  [BUG] For subpage + zoned case, the following workload can lead to rsv data leak at unmount time:    # mkfs.btrfs -f -s 4k $dev   # mount $dev $mnt   # fsstress -w -n 8 -d $mnt -s 1709539240   0/0: fiemap - no filename   0/1: copyrange read - no filename   0/2: write - no filename   0/3: rename - no source filename   0/4: creat f0 x:0 0 0   0/4: creat add id=0,parent=-1   0/5: writev f0[259 1 0 0 0 0] [778052,113,965] 0   0/6: ioctl(FIEMAP) f0[259 1 0 0 224 887097] [1294220,2291618343991484791,0x10000] -1   0/7: dwrite - xfsctl(XFS_IOC_DIOINFO) f0[259 1 0 0 224 887097] return 25, fallback to stat()   0/7: dwrite f0[259 1 0 0 224 887097] [696320,102400] 0   # umount $mnt  The dmesg includes the following rsv leak detection warning (all call trace skipped):    ------------[ cut here ]------------   WARNING: CPU: 2 PID: 4528 at fs/btrfs/inode.c:8653 btrfs_destroy_inode+0x1e0/0x200 [btrfs]   ---[ end trace 0000000000000000 ]---   ------------[ cut here ]------------   WARNING: CPU: 2 PID: 4528 at fs/btrfs/inode.c:8654 btrfs_destroy_inode+0x1a8/0x200 [btrfs]   ---[ end trace 0000000000000000 ]---   ------------[ cut here ]------------   WARNING: CPU: 2 PID: 4528 at fs/btrfs/inode.c:8660 btrfs_destroy_inode+0x1a0/0x200 [btrfs]   ---[ end trace 0000000000000000 ]---   BTRFS info (device sda): last unmount of filesystem 1b4abba9-de34-4f07-9e7f-157cf12a18d6   ------------[ cut here ]------------   WARNING: CPU: 3 PID: 4528 at fs/btrfs/block-group.c:4434 btrfs_free_block_groups+0x338/0x500 [btrfs]   ---[ end trace 0000000000000000 ]---   BTRFS info (device sda): space_info DATA has 268218368 free, is not full   BTRFS info (device sda): space_info total=268435456, used=204800, pinned=0, reserved=0, may_use=12288, readonly=0 zone_unusable=0   BTRFS info (device sda): global_block_rsv: size 0 reserved 0   BTRFS info (device sda): trans_block_rsv: size 0 reserved 0   BTRFS info (device sda): chunk_block_rsv: size 0 reserved 0   BTRFS info (device sda): delayed_block_rsv: size 0 reserved 0   BTRFS info (device sda): delayed_refs_rsv: size 0 reserved 0   ------------[ cut here ]------------   WARNING: CPU: 3 PID: 4528 at fs/btrfs/block-group.c:4434 btrfs_free_block_groups+0x338/0x500 [btrfs]   ---[ end trace 0000000000000000 ]---   BTRFS info (device sda): space_info METADATA has 267796480 free, is not full   BTRFS info (device sda): space_info total=268435456, used=131072, pinned=0, reserved=0, may_use=262144, readonly=0 zone_unusable=245760   BTRFS info (device sda): global_block_rsv: size 0 reserved 0   BTRFS info (device sda): trans_block_rsv: size 0 reserved 0   BTRFS info (device sda): chunk_block_rsv: size 0 reserved 0   BTRFS info (device sda): delayed_block_rsv: size 0 reserved 0   BTRFS info (device sda): delayed_refs_rsv: size 0 reserved 0  Above $dev is a tcmu-runner emulated zoned HDD, which has a max zone append size of 64K, and the system has 64K page size.  [CAUSE] I have added several trace_printk() to show the events (header skipped):    > btrfs_dirty_pages: r/i=5/259 dirty start=774144 len=114688   > btrfs_dirty_pages: r/i=5/259 dirty part of page=720896 off_in_page=53248 len_in_page=12288   > btrfs_dirty_pages: r/i=5/259 dirty part of page=786432 off_in_page=0 len_in_page=65536   > btrfs_dirty_pages: r/i=5/259 dirty part of page=851968 off_in_page=0 len_in_page=36864  The above lines show our buffered write has dirtied 3 pages of inode 259 of root 5:    704K             768K              832K              896K   I           |////I/////////////////I///////////|     I               756K                               868K    |///| is the dirtied range using subpage bitmaps. and 'I' is the page   boundary.    Meanwhile all three pages (704K, 768K, 832K) have their PageDirty   flag set.    > btrfs_direct_write: r/i=5/259 start dio filepos=696320 len=102400  Then direct IO writ ---truncated---

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | kernel-coco sles 15.6 | 6.4.0-15061.6.coco15sp6.1 | [SUSE-SU-2024:3553-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3553-1.md) | Oct 8, 2024 |
| Linux | kernel-coco_debug sles 15.6 | 6.4.0-15061.6.coco15sp6.1 | [SUSE-SU-2024:3553-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3553-1.md) | Oct 8, 2024 |
| Linux | kernel-source-coco sles 15.6 | 6.4.0-15061.6.coco15sp6.1 | [SUSE-SU-2024:3553-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3553-1.md) | Oct 8, 2024 |
| Linux | kernel-syms-coco sles 15.6 | 6.4.0-15061.6.coco15sp6.1 | [SUSE-SU-2024:3553-1](https://patchblox.com/security/data/fix/linux/suse-su-2024-3553-1.md) | Oct 8, 2024 |
| Linux | linux Debian 13.5 (trixie) | 6.10.6-1 | [DEBIAN-CVE-2024-44972](https://patchblox.com/security/data/fix/linux/debian-cve-2024-44972.md) | Sep 4, 2024 |
| Linux | linux Debian 14 | 6.10.6-1 | [DEBIAN-CVE-2024-44972](https://patchblox.com/security/data/fix/linux/debian-cve-2024-44972.md) | Sep 4, 2024 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.