btrfs: zoned: do not flag ZEROOUT on non-dirty extent buffer

published 2024-05-30 2 y ago modified 2026-08-05 3 mo ago also EUVD-2024-35837

cvss: 7.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 11%
public exploits: 0; none known

In the Linux kernel, the following vulnerability has been resolved:

Btrfs clears the content of an extent buffer marked as EXTENT_BUFFER_ZONED_ZEROOUT before the bio submission. This mechanism is introduced to prevent a write hole of an extent buffer, which is once allocated, marked dirty, but turns out unnecessary and cleaned up within one transaction operation.

Currently, btrfs_clear_buffer_dirty() marks the extent buffer as EXTENT_BUFFER_ZONED_ZEROOUT, and skips the entry function. If this call happens while the buffer is under IO (with the WRITEBACK flag set, without the DIRTY flag), we can add the ZEROOUT flag and clear the buffer's content just before a bio submission. As a result:

1) it can lead to adding faulty delayed reference item which leads to a FS corrupted (EUCLEAN) error, and

2) it writes out cleared tree node on disk

The former issue is previously discussed in [1]. The corruption happens when it runs a delayed reference update. So, on-disk data is safe.

[1] https://lore.kernel.org/linux-btrfs/3f4f2a0ff1a6c818050434288925bdcf3cd719e5.1709124777.git.naohiro.aota@wdc.com/

The latter one can reach on-disk data. But, as that node is already processed by btrfs_clear_buffer_dirty(), that will be invalidated in the next transaction commit anyway. So, the chance of hitting the corruption is relatively small.

Anyway, we should skip flagging ZEROOUT on a non-DIRTY extent buffer, to keep the content under IO intact.

Patch / fix

fixed in 1 distros 1 links 2

Linux Linux 6.8.8, 6.9

linux Ubuntu 24.04 LTS 6.8.0-38.38
linux-aws Ubuntu 24.04 LTS 6.8.0-1011.12
linux-gcp Ubuntu 24.04 LTS 6.8.0-1010.11
linux-gke Ubuntu 24.04 LTS 6.8.0-1006.9
linux-ibm Ubuntu 24.04 LTS 6.8.0-1008.8
linux-azure Ubuntu 24.04 LTS 6.8.0-1010.10
linux-intel Ubuntu 24.04 LTS 6.8.0-1007.14
linux-raspi Ubuntu 24.04 LTS 6.8.0-1007.7

ubuntu advisories UBUNTU-CVE-2024-36027

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-36027 updated 2026-11-05 cvss 5.5

kernel: btrfs: zoned: do not flag ZEROOUT on non-dirty extent buffer

Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 y ago (2024-06-17)

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
NVD	3.1	7.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Affected products

Linux Linux

Classification

Technology feeds

Linux kernel rss critical rss

References

Sources

CVE List CVE-2024-36027
NVD CVE-2024-36027

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary