Skip to content
Fencer Vulns
medium 5.5

CVE-2024-35956 json

btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations

published 2024-05-20 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-35752

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 13%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations

Create subvolume, create snapshot and delete subvolume all use btrfs_subvolume_reserve_metadata() to reserve metadata for the changes done to the parent subvolume's fs tree, which cannot be mediated in the normal way via start_transaction. When quota groups (squota or qgroups) are enabled, this reserves qgroup metadata of type PREALLOC. Once the operation is associated to a transaction, we convert PREALLOC to PERTRANS, which gets cleared in bulk at the end of the transaction.

However, the error paths of these three operations were not implementing this lifecycle correctly. They unconditionally converted the PREALLOC to PERTRANS in a generic cleanup step regardless of errors or whether the operation was fully associated to a transaction or not. This resulted in error paths occasionally converting this rsv to PERTRANS without calling record_root_in_trans successfully, which meant that unless that root got recorded in the transaction by some other thread, the end of the transaction would not free that root's PERTRANS, leaking it. Ultimately, this resulted in hitting a WARN in CONFIG_BTRFS_DEBUG builds at unmount for the leaked reservation.

The fix is to ensure that every qgroup PREALLOC reservation observes the following properties:

1. any failure before record_root_in_trans is called successfully results in freeing the PREALLOC reservation. 2. after record_root_in_trans, we convert to PERTRANS, and now the transaction owns freeing the reservation.

This patch enforces those properties on the three operations. Without it, generic/269 with squotas enabled at mkfs time would fail in ~5-10 runs on my system. With this patch, it ran successfully 1000 times in a row.

Patch / fix

  • Linux Linux 5.10, 6.1.120, 6.6.28, 6.8.7, 6.9
  • linux Debian 12 6.1.123-1
  • linux Debian 14, Debian 13 6.8.9-1

debian advisories DEBIAN-CVE-2024-35956

  • linux Ubuntu 24.04 LTS 6.8.0-38.38
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1011.12
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1010.11
  • linux-gke Ubuntu 24.04 LTS 6.8.0-1006.9
  • linux-ibm Ubuntu 24.04 LTS 6.8.0-1008.8
  • linux-azure Ubuntu 24.04 LTS 6.8.0-1010.10
  • linux-intel Ubuntu 24.04 LTS 6.8.0-1007.14
  • linux-raspi Ubuntu 24.04 LTS 6.8.0-1007.7

ubuntu advisories UBUNTU-CVE-2024-35956

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel-source Linux Micro 6.0 6.4.0-18.1
  • kernel-default Linux Micro 6.0 6.4.0-18.1
  • kernel-kvmsmall Linux Micro 6.0 6.4.0-18.1
  • kernel-default-base Linux Micro 6.0 6.4.0-17.1.1.51
  • kernel-rt Real Time Module 15 SP6, openSUSE Leap 15.6 6.4.0-150600.10.5.1
  • kernel-syms-rt Real Time Module 15 SP6, openSUSE Leap 15.6 6.4.0-150600.10.5.1
  • kernel-rt_debug Real Time Module 15 SP6, openSUSE Leap 15.6 6.4.0-150600.10.5.1
  • kernel-source-rt Real Time Module 15 SP6, openSUSE Leap 15.6 6.4.0-150600.10.5.1

suse advisories SUSE-SU-2025:20008-1SUSE-SU-2024:2973-1SUSE-SU-2024:2939-1SUSE-SU-2024:2561-1SUSE-SU-2024:2394-1SUSE-SU-2024:2381-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-35956 updated cvss 5.5

kernel: btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations

  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 13% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Linux Linux

Classification

Weakness
  • CWE-401 Missing Release of Memory after Effective Lifetime
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.