CVE-2024-57896 btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Identified in btrfs Kernel Module Related to Cleaner Kthread Management Two vulnerabilities in the btrfs filesystem have been reported, CVE-2024-49867 and CVE-2024-57896. CVE-2024-49867, published on October 21, 2024, involves issues with stopping the cleaner kthread during unmount, while CVE-2024-57896, published on January 15, 2025, addresses flushing delalloc workers before stopping the cleaner kthread. These vulnerabilities could potentially affect systems using the btrfs filesystem. 2 sources 34