{"id":"DEBIAN-CVE-2024-35798","details":"In the Linux kernel, the following vulnerability has been resolved:  btrfs: fix race in read_extent_buffer_pages()  There are reports from tree-checker that detects corrupted nodes, without any obvious pattern so possibly an overwrite in memory. After some debugging it turns out there's a race when reading an extent buffer the uptodate status can be missed.  To prevent concurrent reads for the same extent buffer, read_extent_buffer_pages() performs these checks:      /* (1) */     if (test_bit(EXTENT_BUFFER_UPTODATE, &eb-\u003ebflags))         return 0;      /* (2) */     if (test_and_set_bit(EXTENT_BUFFER_READING, &eb-\u003ebflags))         goto done;  At this point, it seems safe to start the actual read operation. Once that completes, end_bbio_meta_read() does      /* (3) */     set_extent_buffer_uptodate(eb);      /* (4) */     clear_bit(EXTENT_BUFFER_READING, &eb-\u003ebflags);  Normally, this is enough to ensure only one read happens, and all other callers wait for it to finish before returning.  Unfortunately, there is a racey interleaving:      Thread A | Thread B | Thread C     ---------+----------+---------        (1)   |          |              |    (1)   |        (2)   |          |        (3)   |          |        (4)   |          |              |    (2)   |              |          |    (1)  When this happens, thread B kicks of an unnecessary read. Worse, thread C will see UPTODATE set and return immediately, while the read from thread B is still in progress.  This race could result in tree-checker errors like this as the extent buffer is concurrently modified:      BTRFS critical (device dm-0): corrupted node, root=256     block=8550954455682405139 owner mismatch, have 11858205567642294356     expect [256, 18446744073709551360]  Fix it by testing UPTODATE again after setting the READING bit, and if it's been set, skip the unnecessary read.  [ minor update of changelog ]","modified":"2026-09-15T09:03:02.800381396Z","published":"2024-05-17T14:15:12.170Z","upstream":["CVE-2024-35798"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-35798"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.12-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-35798.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.7.12-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-35798.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}