CVE-2024-49867 btrfs: wait for fixup workers before stopping cleaner kthread during umount

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Identified in btrfs Kernel Module Related to Cleaner Kthread Management Two vulnerabilities in the btrfs filesystem have been reported, CVE-2024-49867 and CVE-2024-57896. CVE-2024-49867, published on October 21, 2024, involves issues with stopping the cleaner kthread during unmount, while CVE-2024-57896, published on January 15, 2025, addresses flushing delalloc workers before stopping the cleaner kthread. These vulnerabilities could potentially affect systems using the btrfs filesystem. 2 sources 34