CVE-2024-46687

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.48/6.10.7

Description A use-after-free vulnerability has been identified in the Linux kernel's btrfs file system, specifically in the btrfs submit chunk() function. This vulnerability can be triggered when the kernel encounters an error while processing a read bio, leading to a double-freeing of memory and potentially causing a use-after-free condition. The vulnerability is caused by the btrfs bio end io() function calling the original endio function, which frees the whole bio, and then later calling the original endio function again, causing a double freeing.

Recommendations To resolve this issue, update the Linux kernel to a version that includes the fix for this vulnerability, which is versions 6.6.48/6.10.7 or later. As a temporary workaround, consider disabling the btrfs submit chunk() function until a patch is available. However, this workaround may have significant performance implications and should be used with caution.