CVE-2024-49867 – A use-after-free vulnerability in the Linux ker... (How to Fix)

Q: What is the severity of CVE-2024-49867?

CVE-2024-49867 has a CVSS score of 5.5 (MEDIUM). A use-after-free vulnerability in the Linux kernel's Btrfs filesystem during unmount can cause kernel crashes or potential privilege escalation. This affects Linux systems using Btrfs filesystems when unmount operations occur while fixup workers are still running. The vulnerability allows a local attacker to trigger a kernel panic or potentially execute arbitrary code.

📋 TL;DR

A use-after-free vulnerability in the Linux kernel's Btrfs filesystem during unmount can cause kernel crashes or potential privilege escalation. This affects Linux systems using Btrfs filesystems when unmount operations occur while fixup workers are still running. The vulnerability allows a local attacker to trigger a kernel panic or potentially execute arbitrary code.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific kernel versions with the vulnerable Btrfs code (check git commits for exact ranges)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems using Btrfs filesystem. Systems not using Btrfs are not vulnerable.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or potential privilege escalation to kernel mode allowing full system compromise.

🟠

Likely Case

System crash or kernel panic during unmount operations, leading to denial of service.

🟢

If Mitigated

No impact if patched or if Btrfs is not used.

🌐 Internet-Facing: LOW - Requires local access to trigger unmount operations.

🏢 Internal Only: MEDIUM - Local users or processes can trigger the vulnerability during unmount operations.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local access and ability to trigger unmount operations. Race condition makes exploitation timing-dependent.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions containing commits: 41fd1e94066a815a7ab0a7025359e9b40e4b3576, 4c98fe0dfa2ae83c4631699695506d8941db4bfe, 65d11eb276836d49003a8060cf31fa2284ad1047, 70b60c8d9b42763d6629e44f448aa5d8ae477d61, 9da40aea63f8769f28afb91aea0fac4cf6fbbb65

Vendor Advisory: https://git.kernel.org/stable/c/41fd1e94066a815a7ab0a7025359e9b40e4b3576

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.

🔧 Temporary Workarounds

Avoid Btrfs unmount operations

linux

Prevent unmount of Btrfs filesystems while system is in use

# Monitor for unmount attempts
# Use mount options to prevent unmount

Use alternative filesystem

linux

Migrate from Btrfs to ext4 or other filesystems

# Backup data
# Convert filesystem or reformat

🧯 If You Can't Patch

Restrict local user access to prevent unmount operations
Monitor for Btrfs unmount events and investigate suspicious activity

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if Btrfs is in use: uname -r and cat /proc/filesystems | grep btrfs

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched and test unmount operations on Btrfs filesystems

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
Btrfs unmount errors
KASAN reports of use-after-free

Network Indicators:

None - local vulnerability

SIEM Query:

Search for: 'KASAN: slab-use-after-free' OR 'btrfs' AND 'panic' OR 'crash' in kernel logs

📊 Metadata

CVE ID: CVE-2024-49867

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-416

Published: October 21, 2024

Last Updated: January 5, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-49867, you might also want to check these: