{"id":"DEBIAN-CVE-2024-44972","details":"In the Linux kernel, the following vulnerability has been resolved:  btrfs: do not clear page dirty inside extent_write_locked_range()  [BUG] For subpage + zoned case, the following workload can lead to rsv data leak at unmount time:    # mkfs.btrfs -f -s 4k $dev   # mount $dev $mnt   # fsstress -w -n 8 -d $mnt -s 1709539240   0/0: fiemap - no filename   0/1: copyrange read - no filename   0/2: write - no filename   0/3: rename - no source filename   0/4: creat f0 x:0 0 0   0/4: creat add id=0,parent=-1   0/5: writev f0[259 1 0 0 0 0] [778052,113,965] 0   0/6: ioctl(FIEMAP) f0[259 1 0 0 224 887097] [1294220,2291618343991484791,0x10000] -1   0/7: dwrite - xfsctl(XFS_IOC_DIOINFO) f0[259 1 0 0 224 887097] return 25, fallback to stat()   0/7: dwrite f0[259 1 0 0 224 887097] [696320,102400] 0   # umount $mnt  The dmesg includes the following rsv leak detection warning (all call trace skipped):    ------------[ cut here ]------------   WARNING: CPU: 2 PID: 4528 at fs/btrfs/inode.c:8653 btrfs_destroy_inode+0x1e0/0x200 [btrfs]   ---[ end trace 0000000000000000 ]---   ------------[ cut here ]------------   WARNING: CPU: 2 PID: 4528 at fs/btrfs/inode.c:8654 btrfs_destroy_inode+0x1a8/0x200 [btrfs]   ---[ end trace 0000000000000000 ]---   ------------[ cut here ]------------   WARNING: CPU: 2 PID: 4528 at fs/btrfs/inode.c:8660 btrfs_destroy_inode+0x1a0/0x200 [btrfs]   ---[ end trace 0000000000000000 ]---   BTRFS info (device sda): last unmount of filesystem 1b4abba9-de34-4f07-9e7f-157cf12a18d6   ------------[ cut here ]------------   WARNING: CPU: 3 PID: 4528 at fs/btrfs/block-group.c:4434 btrfs_free_block_groups+0x338/0x500 [btrfs]   ---[ end trace 0000000000000000 ]---   BTRFS info (device sda): space_info DATA has 268218368 free, is not full   BTRFS info (device sda): space_info total=268435456, used=204800, pinned=0, reserved=0, may_use=12288, readonly=0 zone_unusable=0   BTRFS info (device sda): global_block_rsv: size 0 reserved 0   BTRFS info (device sda): trans_block_rsv: size 0 reserved 0   BTRFS info (device sda): chunk_block_rsv: size 0 reserved 0   BTRFS info (device sda): delayed_block_rsv: size 0 reserved 0   BTRFS info (device sda): delayed_refs_rsv: size 0 reserved 0   ------------[ cut here ]------------   WARNING: CPU: 3 PID: 4528 at fs/btrfs/block-group.c:4434 btrfs_free_block_groups+0x338/0x500 [btrfs]   ---[ end trace 0000000000000000 ]---   BTRFS info (device sda): space_info METADATA has 267796480 free, is not full   BTRFS info (device sda): space_info total=268435456, used=131072, pinned=0, reserved=0, may_use=262144, readonly=0 zone_unusable=245760   BTRFS info (device sda): global_block_rsv: size 0 reserved 0   BTRFS info (device sda): trans_block_rsv: size 0 reserved 0   BTRFS info (device sda): chunk_block_rsv: size 0 reserved 0   BTRFS info (device sda): delayed_block_rsv: size 0 reserved 0   BTRFS info (device sda): delayed_refs_rsv: size 0 reserved 0  Above $dev is a tcmu-runner emulated zoned HDD, which has a max zone append size of 64K, and the system has 64K page size.  [CAUSE] I have added several trace_printk() to show the events (header skipped):    \u003e btrfs_dirty_pages: r/i=5/259 dirty start=774144 len=114688   \u003e btrfs_dirty_pages: r/i=5/259 dirty part of page=720896 off_in_page=53248 len_in_page=12288   \u003e btrfs_dirty_pages: r/i=5/259 dirty part of page=786432 off_in_page=0 len_in_page=65536   \u003e btrfs_dirty_pages: r/i=5/259 dirty part of page=851968 off_in_page=0 len_in_page=36864  The above lines show our buffered write has dirtied 3 pages of inode 259 of root 5:    704K             768K              832K              896K   I           |////I/////////////////I///////////|     I               756K                               868K    |///| is the dirtied range using subpage bitmaps. and 'I' is the page   boundary.    Meanwhile all three pages (704K, 768K, 832K) have their PageDirty   flag set.    \u003e btrfs_direct_write: r/i=5/259 start dio filepos=696320 len=102400  Then direct IO writ ---truncated---","modified":"2026-01-05T19:40:36.034716Z","published":"2024-09-04T19:15:31.430Z","withdrawn":"2026-01-05T19:40:36.034716Z","upstream":["CVE-2024-44972"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-44972"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:11","purl":"pkg:deb/debian/linux?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.103-1","5.10.103-1~bpo10+1","5.10.106-1","5.10.113-1","5.10.120-1","5.10.120-1~bpo10+1","5.10.127-1","5.10.127-2","5.10.127-2~bpo10+1","5.10.136-1","5.10.140-1","5.10.148-1","5.10.149-1","5.10.149-2","5.10.158-1","5.10.158-2","5.10.162-1","5.10.178-1","5.10.178-2","5.10.178-3","5.10.179-1","5.10.179-2","5.10.179-3","5.10.179-4","5.10.179-5","5.10.191-1","5.10.197-1","5.10.205-1","5.10.205-2","5.10.209-1","5.10.209-2","5.10.216-1","5.10.218-1","5.10.221-1","5.10.223-1","5.10.226-1","5.10.234-1","5.10.237-1","5.10.244-1","5.10.46-4","5.10.46-5","5.10.70-1","5.10.70-1~bpo10+1","5.10.84-1","5.10.92-1","5.10.92-1~bpo10+1","5.10.92-2","5.13.12-1~exp1","5.13.9-1~exp1","5.13.9-1~exp2","5.14-1~exp1","5.14-1~exp2","5.14.1-1~exp1","5.14.12-1","5.14.16-1","5.14.2-1~exp1","5.14.3-1~exp1","5.14.6-1","5.14.6-2","5.14.6-3","5.14.9-1","5.14.9-2","5.14.9-2~bpo11+1","5.15-1~exp1","5.15.1-1~exp1","5.15.15-1","5.15.15-2","5.15.15-2~bpo11+1","5.15.2-1~exp1","5.15.3-1","5.15.5-1","5.15.5-2","5.15.5-2~bpo11+1","5.16.10-1","5.16.11-1","5.16.11-1~bpo11+1","5.16.12-1","5.16.12-1~bpo11+1","5.16.14-1","5.16.18-1","5.16.3-1~exp1","5.16.4-1~exp1","5.16.7-1","5.16.7-2","5.16~rc1-1~exp1","5.16~rc3-1~exp1","5.16~rc4-1~exp1","5.16~rc5-1~exp1","5.16~rc6-1~exp1","5.16~rc7-1~exp1","5.16~rc8-1~exp1","5.17.1-1~exp1","5.17.11-1","5.17.3-1","5.17.6-1","5.17~rc3-1~exp1","5.17~rc4-1~exp1","5.17~rc5-1~exp1","5.17~rc6-1~exp1","5.17~rc7-1~exp1","5.17~rc8-1~exp1","5.18-1~exp1","5.18.14-1","5.18.14-1~bpo11+1","5.18.16-1","5.18.16-1~bpo11+1","5.18.2-1","5.18.2-1~bpo11+1","5.18.5-1","5.19-1~exp1","5.19.11-1","5.19.11-1~bpo11+1","5.19.6-1","5.19~rc4-1~exp1","5.19~rc6-1~exp1","6.0-1~exp1","6.0.10-1","6.0.10-2","6.0.12-1","6.0.12-1+alpha","6.0.12-1~bpo11+1","6.0.2-1","6.0.3-1","6.0.3-1~bpo11+1","6.0.5-1","6.0.6-1","6.0.6-2","6.0.7-1","6.0.8-1","6.0~rc7-1~exp1","6.1.1-1~exp1","6.1.1-1~exp2","6.1.106-1","6.1.106-2","6.1.106-3","6.1.11-1","6.1.112-1","6.1.115-1","6.1.119-1","6.1.12-1","6.1.12-1~bpo11+1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.135-1","6.1.137-1","6.1.139-1","6.1.140-1","6.1.147-1","6.1.148-1","6.1.15-1","6.1.15-1~bpo11+1","6.1.153-1","6.1.158-1","6.1.2-1~exp1","6.1.20-1","6.1.20-1~bpo11+1","6.1.20-2","6.1.20-2~bpo11+1","6.1.25-1","6.1.27-1","6.1.27-1~bpo11+1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.4-1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.7-1","6.1.76-1","6.1.76-1~bpo11+1","6.1.8-1","6.1.8-1+sh4","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1","6.10-1~exp1","6.10.1-1~exp1","6.10.11-1","6.10.11-1~bpo12+1","6.10.12-1","6.10.3-1","6.10.4-1","6.10.6-1","6.10.6-1~bpo12+1","6.10.7-1","6.10.9-1","6.11-1~exp1","6.11.10-1","6.11.10-1~bpo12+1","6.11.2-1","6.11.4-1","6.11.5-1","6.11.5-1~bpo12+1","6.11.6-1","6.11.7-1","6.11.9-1","6.11~rc4-1~exp1","6.11~rc5-1~exp1","6.12.10-1","6.12.11-1","6.12.11-1+alpha","6.12.11-1+alpha.1","6.12.12-1","6.12.12-1~bpo12+1","6.12.13-1","6.12.15-1","6.12.16-1","6.12.17-1","6.12.19-1","6.12.20-1","6.12.21-1","6.12.22-1","6.12.22-1~bpo12+1","6.12.25-1","6.12.27-1","6.12.27-1~bpo12+1","6.12.29-1","6.12.3-1","6.12.30-1","6.12.30-1~bpo12+1","6.12.31-1","6.12.32-1","6.12.32-1~bpo12+1","6.12.33-1","6.12.33-1~bpo12+1","6.12.35-1","6.12.35-1~bpo12+1","6.12.37-1","6.12.38-1","6.12.38-1~bpo12+1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.5-1","6.12.57-1","6.12.6-1","6.12.8-1","6.12.9-1","6.12.9-1+alpha","6.12.9-1~bpo12+1","6.12~rc6-1~exp1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.10-1","6.16.11-1","6.16.12-1","6.16.12-2","6.16.3-1","6.16.3-1~bpo13+1","6.16.5-1","6.16.6-1","6.16.7-1","6.16.8-1","6.16.9-1","6.16~rc7-1~exp1","6.17.2-1~exp1","6.17.5-1~exp1","6.17.6-1","6.17.7-1","6.17.7-2","6.17.8-1","6.18~rc4-1~exp1","6.18~rc4-1~exp2","6.18~rc5-1~exp1","6.1~rc3-1~exp1","6.1~rc5-1~exp1","6.1~rc6-1~exp1","6.1~rc7-1~exp1","6.1~rc8-1~exp1","6.3.1-1~exp1","6.3.11-1","6.3.2-1~exp1","6.3.4-1~exp1","6.3.5-1~exp1","6.3.7-1","6.3.7-1~bpo12+1","6.4.1-1~exp1","6.4.11-1","6.4.13-1","6.4.4-1","6.4.4-1~bpo12+1","6.4.4-2","6.4.4-3","6.4.4-3~bpo12+1","6.4~rc6-1~exp1","6.4~rc7-1~exp1","6.5.1-1~exp1","6.5.10-1","6.5.10-1~bpo12+1","6.5.13-1","6.5.3-1","6.5.3-1~bpo12+1","6.5.6-1","6.5.8-1","6.5~rc4-1~exp1","6.5~rc6-1~exp1","6.5~rc7-1~exp1","6.6.11-1","6.6.13-1","6.6.13-1~bpo12+1","6.6.15-1","6.6.15-2","6.6.3-1~exp1","6.6.4-1~exp1","6.6.7-1~exp1","6.6.8-1","6.6.9-1","6.7-1~exp1","6.7.1-1~exp1","6.7.12-1","6.7.12-1~bpo12+1","6.7.4-1~exp1","6.7.7-1","6.7.9-1","6.7.9-2","6.8.11-1","6.8.12-1","6.8.12-1~bpo12+1","6.8.9-1","6.9.10-1","6.9.10-1~bpo12+1","6.9.11-1","6.9.12-1","6.9.2-1~exp1","6.9.7-1","6.9.7-1~bpo12+1","6.9.8-1","6.9.9-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-44972.json"}},{"package":{"name":"linux","ecosystem":"Debian:12","purl":"pkg:deb/debian/linux?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.106-1","6.1.106-2","6.1.106-3","6.1.112-1","6.1.115-1","6.1.119-1","6.1.123-1","6.1.124-1","6.1.128-1","6.1.129-1","6.1.133-1","6.1.135-1","6.1.137-1","6.1.139-1","6.1.140-1","6.1.147-1","6.1.148-1","6.1.153-1","6.1.158-1","6.1.27-1","6.1.37-1","6.1.38-1","6.1.38-2","6.1.38-2~bpo11+1","6.1.38-3","6.1.38-4","6.1.38-4~bpo11+1","6.1.52-1","6.1.55-1","6.1.55-1~bpo11+1","6.1.64-1","6.1.66-1","6.1.67-1","6.1.69-1","6.1.69-1~bpo11+1","6.1.76-1","6.1.76-1~bpo11+1","6.1.82-1","6.1.85-1","6.1.90-1","6.1.90-1~bpo11+1","6.1.94-1","6.1.94-1~bpo11+1","6.1.98-1","6.1.99-1","6.10-1~exp1","6.10.1-1~exp1","6.10.11-1","6.10.11-1~bpo12+1","6.10.12-1","6.10.3-1","6.10.4-1","6.10.6-1","6.10.6-1~bpo12+1","6.10.7-1","6.10.9-1","6.11-1~exp1","6.11.10-1","6.11.10-1~bpo12+1","6.11.2-1","6.11.4-1","6.11.5-1","6.11.5-1~bpo12+1","6.11.6-1","6.11.7-1","6.11.9-1","6.11~rc4-1~exp1","6.11~rc5-1~exp1","6.12.10-1","6.12.11-1","6.12.11-1+alpha","6.12.11-1+alpha.1","6.12.12-1","6.12.12-1~bpo12+1","6.12.13-1","6.12.15-1","6.12.16-1","6.12.17-1","6.12.19-1","6.12.20-1","6.12.21-1","6.12.22-1","6.12.22-1~bpo12+1","6.12.25-1","6.12.27-1","6.12.27-1~bpo12+1","6.12.29-1","6.12.3-1","6.12.30-1","6.12.30-1~bpo12+1","6.12.31-1","6.12.32-1","6.12.32-1~bpo12+1","6.12.33-1","6.12.33-1~bpo12+1","6.12.35-1","6.12.35-1~bpo12+1","6.12.37-1","6.12.38-1","6.12.38-1~bpo12+1","6.12.41-1","6.12.43-1","6.12.43-1~bpo12+1","6.12.48-1","6.12.5-1","6.12.57-1","6.12.6-1","6.12.8-1","6.12.9-1","6.12.9-1+alpha","6.12.9-1~bpo12+1","6.12~rc6-1~exp1","6.13.10-1~exp1","6.13.11-1~exp1","6.13.2-1~exp1","6.13.3-1~exp1","6.13.4-1~exp1","6.13.5-1~exp1","6.13.6-1~exp1","6.13.7-1~exp1","6.13.8-1~exp1","6.13.9-1~exp1","6.13~rc6-1~exp1","6.13~rc7-1~exp1","6.14.3-1~exp1","6.14.5-1~exp1","6.14.6-1~exp1","6.15-1~exp1","6.15.1-1~exp1","6.15.2-1~exp1","6.15.3-1~exp1","6.15.4-1~exp1","6.15.5-1~exp1","6.15.6-1~exp1","6.15~rc7-1~exp1","6.16-1~exp1","6.16.1-1~exp1","6.16.10-1","6.16.11-1","6.16.12-1","6.16.12-2","6.16.3-1","6.16.3-1~bpo13+1","6.16.5-1","6.16.6-1","6.16.7-1","6.16.8-1","6.16.9-1","6.16~rc7-1~exp1","6.17.2-1~exp1","6.17.5-1~exp1","6.17.6-1","6.17.7-1","6.17.7-2","6.17.8-1","6.18~rc4-1~exp1","6.18~rc4-1~exp2","6.18~rc5-1~exp1","6.3.1-1~exp1","6.3.11-1","6.3.2-1~exp1","6.3.4-1~exp1","6.3.5-1~exp1","6.3.7-1","6.3.7-1~bpo12+1","6.4.1-1~exp1","6.4.11-1","6.4.13-1","6.4.4-1","6.4.4-1~bpo12+1","6.4.4-2","6.4.4-3","6.4.4-3~bpo12+1","6.4~rc6-1~exp1","6.4~rc7-1~exp1","6.5.1-1~exp1","6.5.10-1","6.5.10-1~bpo12+1","6.5.13-1","6.5.3-1","6.5.3-1~bpo12+1","6.5.6-1","6.5.8-1","6.5~rc4-1~exp1","6.5~rc6-1~exp1","6.5~rc7-1~exp1","6.6.11-1","6.6.13-1","6.6.13-1~bpo12+1","6.6.15-1","6.6.15-2","6.6.3-1~exp1","6.6.4-1~exp1","6.6.7-1~exp1","6.6.8-1","6.6.9-1","6.7-1~exp1","6.7.1-1~exp1","6.7.12-1","6.7.12-1~bpo12+1","6.7.4-1~exp1","6.7.7-1","6.7.9-1","6.7.9-2","6.8.11-1","6.8.12-1","6.8.12-1~bpo12+1","6.8.9-1","6.9.10-1","6.9.10-1~bpo12+1","6.9.11-1","6.9.12-1","6.9.2-1~exp1","6.9.7-1","6.9.7-1~bpo12+1","6.9.8-1","6.9.9-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-44972.json"}},{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.6-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-44972.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.10.6-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-44972.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}