{"id":"DEBIAN-CVE-2024-48875","details":"In the Linux kernel, the following vulnerability has been resolved:  btrfs: don't take dev_replace rwsem on task already holding it  Running fstests btrfs/011 with MKFS_OPTIONS=\"-O rst\" to force the usage of the RAID stripe-tree, we get the following splat from lockdep:   BTRFS info (device sdd): dev_replace from /dev/sdd (devid 1) to /dev/sdb started   ============================================  WARNING: possible recursive locking detected  6.11.0-rc3-btrfs-for-next #599 Not tainted  --------------------------------------------  btrfs/2326 is trying to acquire lock:  ffff88810f215c98 (&fs_info-\u003edev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250   but task is already holding lock:  ffff88810f215c98 (&fs_info-\u003edev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250   other info that might help us debug this:   Possible unsafe locking scenario:          CPU0         ----    lock(&fs_info-\u003edev_replace.rwsem);    lock(&fs_info-\u003edev_replace.rwsem);    *** DEADLOCK ***    May be due to missing lock nesting notation   1 lock held by btrfs/2326:   #0: ffff88810f215c98 (&fs_info-\u003edev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250   stack backtrace:  CPU: 1 UID: 0 PID: 2326 Comm: btrfs Not tainted 6.11.0-rc3-btrfs-for-next #599  Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011  Call Trace:   \u003cTASK\u003e   dump_stack_lvl+0x5b/0x80   __lock_acquire+0x2798/0x69d0   ? __pfx___lock_acquire+0x10/0x10   ? __pfx___lock_acquire+0x10/0x10   lock_acquire+0x19d/0x4a0   ? btrfs_map_block+0x39f/0x2250   ? __pfx_lock_acquire+0x10/0x10   ? find_held_lock+0x2d/0x110   ? lock_is_held_type+0x8f/0x100   down_read+0x8e/0x440   ? btrfs_map_block+0x39f/0x2250   ? __pfx_down_read+0x10/0x10   ? do_raw_read_unlock+0x44/0x70   ? _raw_read_unlock+0x23/0x40   btrfs_map_block+0x39f/0x2250   ? btrfs_dev_replace_by_ioctl+0xd69/0x1d00   ? btrfs_bio_counter_inc_blocked+0xd9/0x2e0   ? __kasan_slab_alloc+0x6e/0x70   ? __pfx_btrfs_map_block+0x10/0x10   ? __pfx_btrfs_bio_counter_inc_blocked+0x10/0x10   ? kmem_cache_alloc_noprof+0x1f2/0x300   ? mempool_alloc_noprof+0xed/0x2b0   btrfs_submit_chunk+0x28d/0x17e0   ? __pfx_btrfs_submit_chunk+0x10/0x10   ? bvec_alloc+0xd7/0x1b0   ? bio_add_folio+0x171/0x270   ? __pfx_bio_add_folio+0x10/0x10   ? __kasan_check_read+0x20/0x20   btrfs_submit_bio+0x37/0x80   read_extent_buffer_pages+0x3df/0x6c0   btrfs_read_extent_buffer+0x13e/0x5f0   read_tree_block+0x81/0xe0   read_block_for_search+0x4bd/0x7a0   ? __pfx_read_block_for_search+0x10/0x10   btrfs_search_slot+0x78d/0x2720   ? __pfx_btrfs_search_slot+0x10/0x10   ? lock_is_held_type+0x8f/0x100   ? kasan_save_track+0x14/0x30   ? __kasan_slab_alloc+0x6e/0x70   ? kmem_cache_alloc_noprof+0x1f2/0x300   btrfs_get_raid_extent_offset+0x181/0x820   ? __pfx_lock_acquire+0x10/0x10   ? __pfx_btrfs_get_raid_extent_offset+0x10/0x10   ? down_read+0x194/0x440   ? __pfx_down_read+0x10/0x10   ? do_raw_read_unlock+0x44/0x70   ? _raw_read_unlock+0x23/0x40   btrfs_map_block+0x5b5/0x2250   ? __pfx_btrfs_map_block+0x10/0x10   scrub_submit_initial_read+0x8fe/0x11b0   ? __pfx_scrub_submit_initial_read+0x10/0x10   submit_initial_group_read+0x161/0x3a0   ? lock_release+0x20e/0x710   ? __pfx_submit_initial_group_read+0x10/0x10   ? __pfx_lock_release+0x10/0x10   scrub_simple_mirror.isra.0+0x3eb/0x580   scrub_stripe+0xe4d/0x1440   ? lock_release+0x20e/0x710   ? __pfx_scrub_stripe+0x10/0x10   ? __pfx_lock_release+0x10/0x10   ? do_raw_read_unlock+0x44/0x70   ? _raw_read_unlock+0x23/0x40   scrub_chunk+0x257/0x4a0   scrub_enumerate_chunks+0x64c/0xf70   ? __mutex_unlock_slowpath+0x147/0x5f0   ? __pfx_scrub_enumerate_chunks+0x10/0x10   ? bit_wait_timeout+0xb0/0x170   ? __up_read+0x189/0x700   ? scrub_workers_get+0x231/0x300   ? up_write+0x490/0x4f0   btrfs_scrub_dev+0x52e/0xcd0   ? create_pending_snapshots+0x230/0x250   ? __pfx_btrfs_scrub_dev+0x10/0x10   btrfs_dev_replace_by_ioctl+0xd69/0x1d00   ? lock_acquire+0x19d/0x4a0   ? __pfx_btrfs_dev_replace_by_ioctl+0x10/0x10   ? ---truncated---","modified":"2026-09-15T09:02:58.598344797Z","published":"2025-01-11T13:15:22.933Z","upstream":["CVE-2024-48875"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2024-48875"}],"affected":[{"package":{"name":"linux","ecosystem":"Debian:13","purl":"pkg:deb/debian/linux?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.5-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-48875.json"}},{"package":{"name":"linux","ecosystem":"Debian:14","purl":"pkg:deb/debian/linux?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.12.5-1"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2024-48875.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}