Improper locking in Linux kernel - CVE-2024-57975

Vulnerability identifier: #VU105023

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-57975

CWE-ID: CWE-667

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the can_nocow_file_extent() and run_delalloc_nocow() functions in fs/btrfs/inode.c. A local user can perform a denial of service (DoS) attack.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-6.8 (Ubuntu package)
linux-aws-6.8 (Ubuntu package)
linux-azure (Ubuntu package)
linux-raspi (Ubuntu package)
linux-gcp (Ubuntu package)
linux-raspi-realtime (Ubuntu package)
linux-realtime (Ubuntu package)

Install update from vendor's website.

Linux kernel - addressed in versions 6.12.13, 6.13.2, 6.14
linux (Ubuntu package) - addressed in versions 6.8.0-64.67, 6.8.0-1031.31, 6.8.0-1032.34~22.04.1
linux-ibm (Ubuntu package) - addressed in versions 6.8.0-64.67.1, 6.8.0-64.67.1~22.04.1, 6.8.0-1029.29, 6.8.0-1029.29~22.04.1
linux-hwe-6.8 (Ubuntu package) - update to 6.8.0-64.67~22.04.1
linux-aws-6.8 (Ubuntu package) - addressed in versions 6.8.0-1015.17, 6.8.0-1028.32, 6.8.0-1029.30, 6.8.0-1029.30~22.04.1, 6.8.0-1031.34, 6.8.0-1031.34.1, 6.8.0-1031.34~22.04.1, 6.8.0-1032.34~22.04.1
linux-azure (Ubuntu package) - addressed in versions 6.8.0-1022.23, 6.8.0-1034.39, 6.8.0-1034.39~22.04.1
linux-raspi (Ubuntu package) - update to 6.8.0-1031.35
linux-gcp (Ubuntu package) - addressed in versions 6.8.0-1033.35, 6.8.0-1033.35~22.04.1
linux-raspi-realtime (Ubuntu package) - update to 6.8.0-2026.27
linux-realtime (Ubuntu package) - update to 6.8.1-1025.26

• https://git.kernel.org/stable/c/2434533f1c963e7317c45880c98287e5bed98325
• https://git.kernel.org/stable/c/5ae72abbf91eb172ce3a838a4dc34be3c9707296
• https://git.kernel.org/stable/c/c2b47df81c8e20a8e8cd94f0d7df211137ae94ed
• https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.13
• https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.13.2
• https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.14

• Improper locking in Linux kernel btrfs
• Ubuntu update for linux-hwe-6.8
• Ubuntu update for linux-realtime
• Ubuntu update for linux
• Ubuntu update for linux-ibm
• Ubuntu update for linux-aws-6.8
• Ubuntu update for linux-gcp
• Ubuntu update for linux-raspi-realtime
• Ubuntu update for linux-raspi
• Ubuntu update for linux-azure