{"id":"CVE-2024-44963","revision":"852ac04ecff84e17a1c175f953b00169","records":[{"revision":"852ac04ecff84e17a1c175f953b00169","observedAt":"2026-10-30T13:45:33.454+00:00","statement":{"source":"cve-program","id":"CVE-2024-44963","aliases":[],"title":"btrfs: do not BUG_ON() when freeing tree block after error","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not BUG_ON() when freeing tree block after error\n\nWhen freeing a tree block, at btrfs_free_tree_block(), if we fail to\ncreate a delayed reference we don't deal with the error and just do a\nBUG_ON(). The error most likely to happen is -ENOMEM, and we have a\ncomment mentioning that only -ENOMEM can happen, but that is not true,\nbecause in case qgroups are enabled any error returned from\nbtrfs_qgroup_trace_extent_post() (can be -EUCLEAN or anything returned\nfrom btrfs_search_slot() for example) can be propagated back to\nbtrfs_free_tree_block().\n\nSo stop doing a BUG_ON() and return the error to the callers and make\nthem abort the transaction to prevent leaking space. Syzbot was\ntriggering this, likely due to memory allocation failure injection.","state":0,"publishedAt":"2024-09-04T18:36:00.948+00:00","modifiedAt":"2026-10-30T12:19:11.923+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/btrfs/ctree.c\",\n                        \"fs/btrfs/extent-tree.c\",\n                        \"fs/btrfs/extent-tree.h\",\n                        \"fs/btrfs/free-space-tree.c\",\n                        \"fs/btrfs/ioctl.c\",\n                        \"fs/btrfs/qgroup.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"fb235dc06fac9eaa4408ade9c8b20d45d63c89b7\",\n                            \"lessThan\": \"bfcef12f80b3a9bd6b09c7305679164e3307328a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fb235dc06fac9eaa4408ade9c8b20d45d63c89b7\",\n                            \"lessThan\": \"22d907bcd283d69d5e60497fc0d51969545c583b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fb235dc06fac9eaa4408ade9c8b20d45d63c89b7\",\n                            \"lessThan\": \"98251cd60b4d702a8a81de442ab621e83a3fb24f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fb235dc06fac9eaa4408ade9c8b20d45d63c89b7\",\n                            \"lessThan\": \"bb3868033a4cccff7be57e9145f2117cbdc91c11\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/btrfs/ctree.c\",\n                        \"fs/btrfs/extent-tree.c\",\n                        \"fs/btrfs/extent-tree.h\",\n                        \"fs/btrfs/free-space-tree.c\",\n                        \"fs/btrfs/ioctl.c\",\n                        \"fs/btrfs/qgroup.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"4.11\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"4.11\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.191\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.64\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.10.5\",\n                            \"lessThanOrEqual\": \"6.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.11\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/bfcef12f80b3a9bd6b09c7305679164e3307328a","https://git.kernel.org/stable/c/22d907bcd283d69d5e60497fc0d51969545c583b","https://git.kernel.org/stable/c/98251cd60b4d702a8a81de442ab621e83a3fb24f","https://git.kernel.org/stable/c/bb3868033a4cccff7be57e9145f2117cbdc91c11"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-44963","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-44963","identifiers":["CVE-2024-44963"]},"retained":false,"historicalAffected":[]}],"coverage":[]}