CVE-2024-41078

btrfs: qgroup: fix quota root leak after quota disable failure

MEDIUM

5.5

CVSS Score

Published: July 29, 2024 at 03:04 PM UTC

Updated: June 17, 2026 at 07:47 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix quota root leak after quota disable failure If during the quota disable we fail when cleaning the quota tree or when deleting the root from the root tree, we jump to the 'out' label without ever dropping the reference on the quota root, resulting in a leak of the root since fs_info->quota_root is no longer pointing to the root (we have set it to NULL just before those steps). Fix this by always doing a btrfs_put_root() call under the 'out' label. This is a problem that exists since qgroups were first added in 2012 by commit bed92eae26cc ("Btrfs: qgroup implementation and prototypes"), but back then we missed a kfree on the quota root and free_extent_buffer() calls on its root and commit root nodes, since back then roots were not yet reference counted.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

v < 5.10.2233.6 ≤ v < 5.10.2233.6 ≤ v < 5.15.1643.6 ≤ v < 6.1.1013.6 ≤ v < 6.103.6 ≤ v < 6.6.423.6 ≤ v < 6.9.115.11 ≤ v < 5.15.1645.16 ≤ v < 6.1.1016.2 ≤ v < 6.6.426.7 ≤ v < 6.9.113.6 6.10 rc1 6.10 rc2 6.10 rc3 6.10 rc4 6.10 rc5bed92eae26ccf280d1a2168b7509447b56675a27

Vendor states this is fixed in 5ef3961682e5310f2221bae99bcf9f5d0f4b0d51 (fixed)

Vendor states this is fixed in 7dd6a5b96157a21245566b21fd58276a214357ff (fixed)

Vendor states this is fixed in 8a69529f22590b67bb018de9acbcf94abc8603cf (fixed)

Vendor states this is fixed in 94818bdb00ef34a996a06aa63d11f591074cb757 (fixed)

Vendor states this is fixed in a7e4c6a3031c74078dba7fa36239d0f4fe476c53 (fixed)

Vendor states this is fixed in f88aeff5a173e8ba3133314eb4b964236ef3589d (fixed)

Vendor states this is fixed in 3.6 (unaffected)

Vendor states this is fixed in 5.10.223 (unaffected)

Vendor states this is fixed in 5.15.164 (unaffected)

Vendor states this is fixed in 6.1.101 (unaffected)

Vendor states this is fixed in 6.10 (unaffected)

Vendor states this is fixed in 6.6.42 (unaffected)