GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-50273 (GCVE-0-2024-50273)

Vulnerability from cvelistv5 – Published: 2024-11-19 01:30 – Updated: 2026-08-05 11:42
VLAI
Title
btrfs: reinitialize delayed ref list after deleting it from the list
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: reinitialize delayed ref list after deleting it from the list At insert_delayed_ref() if we need to update the action of an existing ref to BTRFS_DROP_DELAYED_REF, we delete the ref from its ref head's ref_add_list using list_del(), which leaves the ref's add_list member not reinitialized, as list_del() sets the next and prev members of the list to LIST_POISON1 and LIST_POISON2, respectively. If later we end up calling drop_delayed_ref() against the ref, which can happen during merging or when destroying delayed refs due to a transaction abort, we can trigger a crash since at drop_delayed_ref() we call list_empty() against the ref's add_list, which returns false since the list was not reinitialized after the list_del() and as a consequence we call list_del() again at drop_delayed_ref(). This results in an invalid list access since the next and prev members are set to poison pointers, resulting in a splat if CONFIG_LIST_HARDENED and CONFIG_DEBUG_LIST are set or invalid poison pointer dereferences otherwise. So fix this by deleting from the list with list_del_init() instead.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 20:14 UTC
CWE
  • CWE-908 - Use of Uninitialized Resource
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1d57ee941692d0cc928526e21a1557b2ae3e11db , < 2fd0948a483e9cb2d669c7199bc620a21c97673d (git)
Affected: 1d57ee941692d0cc928526e21a1557b2ae3e11db , < 93c5b8decc0ef39ba84f4211d2db6da0a4aefbeb (git)
Affected: 1d57ee941692d0cc928526e21a1557b2ae3e11db , < bf0b0c6d159767c0d1c21f793950d78486690ee0 (git)
Affected: 1d57ee941692d0cc928526e21a1557b2ae3e11db , < c24fa427fc0ae827b2a3a07f13738cbf82c3f851 (git)
Affected: 1d57ee941692d0cc928526e21a1557b2ae3e11db , < 2cb1a73d1d44a1c11b0ee5eeced765dd80ec48e6 (git)
Affected: 1d57ee941692d0cc928526e21a1557b2ae3e11db , < f04be6d68f715c1473a8422fc0460f57b5e99931 (git)
Affected: 1d57ee941692d0cc928526e21a1557b2ae3e11db , < 50a3933760b427759afdd23156a7280a19357a92 (git)
Affected: 1d57ee941692d0cc928526e21a1557b2ae3e11db , < c9a75ec45f1111ef530ab186c2a7684d0a0c9245 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.10
Unaffected: 0 , < 4.10 (semver)
Unaffected: 4.19.324 , ≤ 4.19.* (semver)
Unaffected: 5.4.286 , ≤ 5.4.* (semver)
Unaffected: 5.10.230 , ≤ 5.10.* (semver)
Unaffected: 5.15.172 , ≤ 5.15.* (semver)
Unaffected: 6.1.117 , ≤ 6.1.* (semver)
Unaffected: 6.6.61 , ≤ 6.6.* (semver)
Unaffected: 6.11.8 , ≤ 6.11.* (semver)
Unaffected: 6.12 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50273",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:14:59.605584Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-908",
                "description": "CWE-908 Use of Uninitialized Resource",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:17:23.045Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:27:54.002Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/delayed-ref.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2fd0948a483e9cb2d669c7199bc620a21c97673d",
              "status": "affected",
              "version": "1d57ee941692d0cc928526e21a1557b2ae3e11db",
              "versionType": "git"
            },
            {
              "lessThan": "93c5b8decc0ef39ba84f4211d2db6da0a4aefbeb",
              "status": "affected",
              "version": "1d57ee941692d0cc928526e21a1557b2ae3e11db",
              "versionType": "git"
            },
            {
              "lessThan": "bf0b0c6d159767c0d1c21f793950d78486690ee0",
              "status": "affected",
              "version": "1d57ee941692d0cc928526e21a1557b2ae3e11db",
              "versionType": "git"
            },
            {
              "lessThan": "c24fa427fc0ae827b2a3a07f13738cbf82c3f851",
              "status": "affected",
              "version": "1d57ee941692d0cc928526e21a1557b2ae3e11db",
              "versionType": "git"
            },
            {
              "lessThan": "2cb1a73d1d44a1c11b0ee5eeced765dd80ec48e6",
              "status": "affected",
              "version": "1d57ee941692d0cc928526e21a1557b2ae3e11db",
              "versionType": "git"
            },
            {
              "lessThan": "f04be6d68f715c1473a8422fc0460f57b5e99931",
              "status": "affected",
              "version": "1d57ee941692d0cc928526e21a1557b2ae3e11db",
              "versionType": "git"
            },
            {
              "lessThan": "50a3933760b427759afdd23156a7280a19357a92",
              "status": "affected",
              "version": "1d57ee941692d0cc928526e21a1557b2ae3e11db",
              "versionType": "git"
            },
            {
              "lessThan": "c9a75ec45f1111ef530ab186c2a7684d0a0c9245",
              "status": "affected",
              "version": "1d57ee941692d0cc928526e21a1557b2ae3e11db",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/delayed-ref.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.10"
            },
            {
              "lessThan": "4.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.324",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.286",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.230",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.172",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.324",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.286",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.230",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.172",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.117",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.61",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.8",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: reinitialize delayed ref list after deleting it from the list\n\nAt insert_delayed_ref() if we need to update the action of an existing\nref to BTRFS_DROP_DELAYED_REF, we delete the ref from its ref head\u0027s\nref_add_list using list_del(), which leaves the ref\u0027s add_list member\nnot reinitialized, as list_del() sets the next and prev members of the\nlist to LIST_POISON1 and LIST_POISON2, respectively.\n\nIf later we end up calling drop_delayed_ref() against the ref, which can\nhappen during merging or when destroying delayed refs due to a transaction\nabort, we can trigger a crash since at drop_delayed_ref() we call\nlist_empty() against the ref\u0027s add_list, which returns false since\nthe list was not reinitialized after the list_del() and as a consequence\nwe call list_del() again at drop_delayed_ref(). This results in an\ninvalid list access since the next and prev members are set to poison\npointers, resulting in a splat if CONFIG_LIST_HARDENED and\nCONFIG_DEBUG_LIST are set or invalid poison pointer dereferences\notherwise.\n\nSo fix this by deleting from the list with list_del_init() instead."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The delayed-ref machinery is driven by local filesystem syscalls (write, truncate, unlink, clone, subvolume/snapshot operations) against a mounted btrfs; there is no network-facing path into `insert_delayed_ref()`.\nAC:L - The attacker drives both halves entirely through their own workload \u2014 generating the delayed-ref sequence and then forcing `btrfs_merge_delayed_refs()`/transaction-abort cleanup via ordinary file I/O \u2014 with no dependence on external state or a race they cannot influence.\nPR:L - Only an unprivileged local account with write access to any btrfs filesystem (e.g. a home directory on a btrfs root fs) is needed; no CAP_SYS_ADMIN, no mount privileges, and no root in the init namespace.\nUI:N - No victim action is required \u2014 the attacker\u0027s own file operations on an already-mounted btrfs create the delayed refs and trigger the subsequent merge or abort-time cleanup.\nS:U - The corrupted list state and resulting fault are confined to the kernel\u0027s own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The double `list_del()` on a poisoned list entry is a list-corruption/memory-corruption condition in delayed-ref bookkeeping that, consistent with other btrfs list-corruption issues, can be leveraged toward disclosure of kernel memory contents.\nI:H - `__list_del()` performs two pointer writes derived from the corrupted `add_list` members, an unintended kernel write of the kind that underpins list-corruption exploitation, and the delayed-ref/extent accounting is left inconsistent on the affected filesystem.\nA:H - Dereferencing LIST_POISON1/LIST_POISON2 produces a kernel oops (or a hardened-list splat) while `head-\u003elock` and `delayed_refs-\u003elock` are held, hanging every other btrfs task on the filesystem and effectively panicking the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:42:57.250Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2fd0948a483e9cb2d669c7199bc620a21c97673d"
        },
        {
          "url": "https://git.kernel.org/stable/c/93c5b8decc0ef39ba84f4211d2db6da0a4aefbeb"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf0b0c6d159767c0d1c21f793950d78486690ee0"
        },
        {
          "url": "https://git.kernel.org/stable/c/c24fa427fc0ae827b2a3a07f13738cbf82c3f851"
        },
        {
          "url": "https://git.kernel.org/stable/c/2cb1a73d1d44a1c11b0ee5eeced765dd80ec48e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/f04be6d68f715c1473a8422fc0460f57b5e99931"
        },
        {
          "url": "https://git.kernel.org/stable/c/50a3933760b427759afdd23156a7280a19357a92"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9a75ec45f1111ef530ab186c2a7684d0a0c9245"
        }
      ],
      "title": "btrfs: reinitialize delayed ref list after deleting it from the list",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50273",
    "datePublished": "2024-11-19T01:30:12.589Z",
    "dateReserved": "2024-10-21T19:36:19.983Z",
    "dateUpdated": "2026-08-05T11:42:57.250Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-50273",
      "date": "2026-09-19",
      "epss": "0.0029",
      "percentile": "0.21818"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "037E197F-690E-4813-96DE-599751FC2D28",
                  "versionEndExcluding": "4.19.324",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "9952C897-8A61-4D4B-9D6D-7D063E9EA15E",
                  "versionEndExcluding": "5.4.286",
                  "versionStartIncluding": "4.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "BF5B32D0-72C9-41C3-A0BB-D4946153C134",
                  "versionEndExcluding": "5.10.230",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "88812664-4296-42AC-AE0F-ED71086C1BB1",
                  "versionEndExcluding": "5.15.172",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "0DD7F755-2F6B-4707-8973-78496AD5AA8E",
                  "versionEndExcluding": "6.1.117",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "630ED7EB-C97E-4435-B884-1E309E40D6F3",
                  "versionEndExcluding": "6.6.61",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "0BD000F7-3DAD-4DD3-8906-98EA1EC67E95",
                  "versionEndExcluding": "6.11.8",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*",
                  "matchCriteriaId": "7F361E1D-580F-4A2D-A509-7615F73167A1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*",
                  "matchCriteriaId": "925478D0-3E3D-4E6F-ACD5-09F28D5DF82C",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*",
                  "matchCriteriaId": "3C95E234-D335-4B6C-96BF-E2CEBD8654ED",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*",
                  "matchCriteriaId": "E0F717D8-3014-4F84-8086-0124B2111379",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*",
                  "matchCriteriaId": "24DBE6C7-2AAE-4818-AED2-E131F153D2FA",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*",
                  "matchCriteriaId": "24B88717-53F5-42AA-9B72-14C707639E3F",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: reinitialize delayed ref list after deleting it from the list\n\nAt insert_delayed_ref() if we need to update the action of an existing\nref to BTRFS_DROP_DELAYED_REF, we delete the ref from its ref head\u0027s\nref_add_list using list_del(), which leaves the ref\u0027s add_list member\nnot reinitialized, as list_del() sets the next and prev members of the\nlist to LIST_POISON1 and LIST_POISON2, respectively.\n\nIf later we end up calling drop_delayed_ref() against the ref, which can\nhappen during merging or when destroying delayed refs due to a transaction\nabort, we can trigger a crash since at drop_delayed_ref() we call\nlist_empty() against the ref\u0027s add_list, which returns false since\nthe list was not reinitialized after the list_del() and as a consequence\nwe call list_del() again at drop_delayed_ref(). This results in an\ninvalid list access since the next and prev members are set to poison\npointers, resulting in a splat if CONFIG_LIST_HARDENED and\nCONFIG_DEBUG_LIST are set or invalid poison pointer dereferences\notherwise.\n\nSo fix this by deleting from the list with list_del_init() instead."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: reinicializar la lista de referencias retrasadas despu\u00e9s de eliminarla de la lista En insert_delayed_ref(), si necesitamos actualizar la acci\u00f3n de una referencia existente a BTRFS_DROP_DELAYED_REF, eliminamos la referencia de ref_add_list de su cabecera de referencia usando list_del(), lo que deja el miembro add_list de la referencia sin reinicializar, ya que list_del() establece los miembros siguiente y anterior de la lista en LIST_POISON1 y LIST_POISON2, respectivamente. Si m\u00e1s tarde terminamos llamando a drop_delayed_ref() contra la referencia, lo que puede suceder durante la fusi\u00f3n o al destruir referencias retrasadas debido a un aborto de transacci\u00f3n, podemos provocar un bloqueo ya que en drop_delayed_ref() llamamos a list_empty() contra el add_list de la referencia, que devuelve falso ya que la lista no se reinicializ\u00f3 despu\u00e9s de list_del() y, como consecuencia, llamamos a list_del() nuevamente en drop_delayed_ref(). Esto da como resultado un acceso a la lista no v\u00e1lido ya que los miembros next y prev est\u00e1n configurados como punteros envenenados, lo que resulta en un splat si CONFIG_LIST_HARDENED y CONFIG_DEBUG_LIST est\u00e1n configurados o desreferencias de punteros envenenados no v\u00e1lidas en caso contrario. As\u00ed que solucione esto eliminando de la lista con list_del_init() en su lugar."
        }
      ],
      "id": "CVE-2024-50273",
      "lastModified": "2024-11-27T15:58:02.730",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 3.6,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2024-11-19T02:16:29.483",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/2cb1a73d1d44a1c11b0ee5eeced765dd80ec48e6"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/2fd0948a483e9cb2d669c7199bc620a21c97673d"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/50a3933760b427759afdd23156a7280a19357a92"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/93c5b8decc0ef39ba84f4211d2db6da0a4aefbeb"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/bf0b0c6d159767c0d1c21f793950d78486690ee0"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/c24fa427fc0ae827b2a3a07f13738cbf82c3f851"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/c9a75ec45f1111ef530ab186c2a7684d0a0c9245"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "tags": [
            "Patch"
          ],
          "url": "https://git.kernel.org/stable/c/f04be6d68f715c1473a8422fc0460f57b5e99931"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-908"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-19T01:01:43.000Z",
      "cve": "CVE-2024-50273",
      "id": "msrc_CVE-2024-50273",
      "initial_release_date": "2024-11-02T00:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "btrfs: reinitialize delayed ref list after deleting it from the list",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-50273.json",
      "version": "3"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/btrfs/delayed-ref.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2fd0948a483e9cb2d669c7199bc620a21c97673d",
                    "status": "affected",
                    "version": "1d57ee941692d0cc928526e21a1557b2ae3e11db",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "93c5b8decc0ef39ba84f4211d2db6da0a4aefbeb",
                    "status": "affected",
                    "version": "1d57ee941692d0cc928526e21a1557b2ae3e11db",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bf0b0c6d159767c0d1c21f793950d78486690ee0",
                    "status": "affected",
                    "version": "1d57ee941692d0cc928526e21a1557b2ae3e11db",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c24fa427fc0ae827b2a3a07f13738cbf82c3f851",
                    "status": "affected",
                    "version": "1d57ee941692d0cc928526e21a1557b2ae3e11db",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2cb1a73d1d44a1c11b0ee5eeced765dd80ec48e6",
                    "status": "affected",
                    "version": "1d57ee941692d0cc928526e21a1557b2ae3e11db",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f04be6d68f715c1473a8422fc0460f57b5e99931",
                    "status": "affected",
                    "version": "1d57ee941692d0cc928526e21a1557b2ae3e11db",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "50a3933760b427759afdd23156a7280a19357a92",
                    "status": "affected",
                    "version": "1d57ee941692d0cc928526e21a1557b2ae3e11db",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c9a75ec45f1111ef530ab186c2a7684d0a0c9245",
                    "status": "affected",
                    "version": "1d57ee941692d0cc928526e21a1557b2ae3e11db",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/btrfs/delayed-ref.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.10"
                  },
                  {
                    "lessThan": "4.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.324",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.286",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.230",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.172",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.117",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.61",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.11.*",
                    "status": "unaffected",
                    "version": "6.11.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.12",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "037E197F-690E-4813-96DE-599751FC2D28",
                    "versionEndExcluding": "4.19.324",
                    "versionStartIncluding": "4.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9952C897-8A61-4D4B-9D6D-7D063E9EA15E",
                    "versionEndExcluding": "5.4.286",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BF5B32D0-72C9-41C3-A0BB-D4946153C134",
                    "versionEndExcluding": "5.10.230",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "88812664-4296-42AC-AE0F-ED71086C1BB1",
                    "versionEndExcluding": "5.15.172",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0DD7F755-2F6B-4707-8973-78496AD5AA8E",
                    "versionEndExcluding": "6.1.117",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "630ED7EB-C97E-4435-B884-1E309E40D6F3",
                    "versionEndExcluding": "6.6.61",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0BD000F7-3DAD-4DD3-8906-98EA1EC67E95",
                    "versionEndExcluding": "6.11.8",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "7F361E1D-580F-4A2D-A509-7615F73167A1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "925478D0-3E3D-4E6F-ACD5-09F28D5DF82C",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "3C95E234-D335-4B6C-96BF-E2CEBD8654ED",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "E0F717D8-3014-4F84-8086-0124B2111379",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "24DBE6C7-2AAE-4818-AED2-E131F153D2FA",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "24B88717-53F5-42AA-9B72-14C707639E3F",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: reinitialize delayed ref list after deleting it from the list\n\nAt insert_delayed_ref() if we need to update the action of an existing\nref to BTRFS_DROP_DELAYED_REF, we delete the ref from its ref head\u0027s\nref_add_list using list_del(), which leaves the ref\u0027s add_list member\nnot reinitialized, as list_del() sets the next and prev members of the\nlist to LIST_POISON1 and LIST_POISON2, respectively.\n\nIf later we end up calling drop_delayed_ref() against the ref, which can\nhappen during merging or when destroying delayed refs due to a transaction\nabort, we can trigger a crash since at drop_delayed_ref() we call\nlist_empty() against the ref\u0027s add_list, which returns false since\nthe list was not reinitialized after the list_del() and as a consequence\nwe call list_del() again at drop_delayed_ref(). This results in an\ninvalid list access since the next and prev members are set to poison\npointers, resulting in a splat if CONFIG_LIST_HARDENED and\nCONFIG_DEBUG_LIST are set or invalid poison pointer dereferences\notherwise.\n\nSo fix this by deleting from the list with list_del_init() instead."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: reinicializar la lista de referencias retrasadas despu\u00e9s de eliminarla de la lista En insert_delayed_ref(), si necesitamos actualizar la acci\u00f3n de una referencia existente a BTRFS_DROP_DELAYED_REF, eliminamos la referencia de ref_add_list de su cabecera de referencia usando list_del(), lo que deja el miembro add_list de la referencia sin reinicializar, ya que list_del() establece los miembros siguiente y anterior de la lista en LIST_POISON1 y LIST_POISON2, respectivamente. Si m\u00e1s tarde terminamos llamando a drop_delayed_ref() contra la referencia, lo que puede suceder durante la fusi\u00f3n o al destruir referencias retrasadas debido a un aborto de transacci\u00f3n, podemos provocar un bloqueo ya que en drop_delayed_ref() llamamos a list_empty() contra el add_list de la referencia, que devuelve falso ya que la lista no se reinicializ\u00f3 despu\u00e9s de list_del() y, como consecuencia, llamamos a list_del() nuevamente en drop_delayed_ref(). Esto da como resultado un acceso a la lista no v\u00e1lido ya que los miembros next y prev est\u00e1n configurados como punteros envenenados, lo que resulta en un splat si CONFIG_LIST_HARDENED y CONFIG_DEBUG_LIST est\u00e1n configurados o desreferencias de punteros envenenados no v\u00e1lidas en caso contrario. As\u00ed que solucione esto eliminando de la lista con list_del_init() en su lugar."
          }
        ],
        "id": "CVE-2024-50273",
        "lastModified": "2026-08-04T11:21:39.270",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-50273",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:14:59.605584Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-11-19T02:16:29.483",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2cb1a73d1d44a1c11b0ee5eeced765dd80ec48e6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2fd0948a483e9cb2d669c7199bc620a21c97673d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/50a3933760b427759afdd23156a7280a19357a92"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/93c5b8decc0ef39ba84f4211d2db6da0a4aefbeb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bf0b0c6d159767c0d1c21f793950d78486690ee0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c24fa427fc0ae827b2a3a07f13738cbf82c3f851"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c9a75ec45f1111ef530ab186c2a7684d0a0c9245"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/f04be6d68f715c1473a8422fc0460f57b5e99931"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-908"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-908"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2025-11-21T14:18:21+00:00",
      "cve": "CVE-2024-50273",
      "id": "CVE-2024-50273",
      "initial_release_date": "2024-11-19T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: btrfs: reinitialize delayed ref list after deleting it from the list",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-50273.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-19T02:14:49Z",
      "cve": "CVE-2024-50273",
      "id": "CVE-2024-50273",
      "initial_release_date": "2024-11-19T03:49:25Z",
      "product_status:known_affected": "623",
      "product_status:known_not_affected": "74",
      "product_status:recommended": "589",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-50273",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-50273.json",
      "version": "60"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2025-11-03T22:27:54.002Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html"
              },
              {
                "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 5.5,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-50273",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-01T20:14:59.605584Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-908",
                    "description": "CWE-908 Use of Uninitialized Resource",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-01T15:26:12.402Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "fs/btrfs/delayed-ref.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "2fd0948a483e9cb2d669c7199bc620a21c97673d",
                  "status": "affected",
                  "version": "1d57ee941692d0cc928526e21a1557b2ae3e11db",
                  "versionType": "git"
                },
                {
                  "lessThan": "93c5b8decc0ef39ba84f4211d2db6da0a4aefbeb",
                  "status": "affected",
                  "version": "1d57ee941692d0cc928526e21a1557b2ae3e11db",
                  "versionType": "git"
                },
                {
                  "lessThan": "bf0b0c6d159767c0d1c21f793950d78486690ee0",
                  "status": "affected",
                  "version": "1d57ee941692d0cc928526e21a1557b2ae3e11db",
                  "versionType": "git"
                },
                {
                  "lessThan": "c24fa427fc0ae827b2a3a07f13738cbf82c3f851",
                  "status": "affected",
                  "version": "1d57ee941692d0cc928526e21a1557b2ae3e11db",
                  "versionType": "git"
                },
                {
                  "lessThan": "2cb1a73d1d44a1c11b0ee5eeced765dd80ec48e6",
                  "status": "affected",
                  "version": "1d57ee941692d0cc928526e21a1557b2ae3e11db",
                  "versionType": "git"
                },
                {
                  "lessThan": "f04be6d68f715c1473a8422fc0460f57b5e99931",
                  "status": "affected",
                  "version": "1d57ee941692d0cc928526e21a1557b2ae3e11db",
                  "versionType": "git"
                },
                {
                  "lessThan": "50a3933760b427759afdd23156a7280a19357a92",
                  "status": "affected",
                  "version": "1d57ee941692d0cc928526e21a1557b2ae3e11db",
                  "versionType": "git"
                },
                {
                  "lessThan": "c9a75ec45f1111ef530ab186c2a7684d0a0c9245",
                  "status": "affected",
                  "version": "1d57ee941692d0cc928526e21a1557b2ae3e11db",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "fs/btrfs/delayed-ref.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.10"
                },
                {
                  "lessThan": "4.10",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.324",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.286",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.230",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.172",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.1.*",
                  "status": "unaffected",
                  "version": "6.1.117",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.6.*",
                  "status": "unaffected",
                  "version": "6.6.61",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "6.11.*",
                  "status": "unaffected",
                  "version": "6.11.8",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.12",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.324",
                      "versionStartIncluding": "4.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.286",
                      "versionStartIncluding": "4.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.230",
                      "versionStartIncluding": "4.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.172",
                      "versionStartIncluding": "4.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.1.117",
                      "versionStartIncluding": "4.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.6.61",
                      "versionStartIncluding": "4.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.11.8",
                      "versionStartIncluding": "4.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.12",
                      "versionStartIncluding": "4.10",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: reinitialize delayed ref list after deleting it from the list\n\nAt insert_delayed_ref() if we need to update the action of an existing\nref to BTRFS_DROP_DELAYED_REF, we delete the ref from its ref head\u0027s\nref_add_list using list_del(), which leaves the ref\u0027s add_list member\nnot reinitialized, as list_del() sets the next and prev members of the\nlist to LIST_POISON1 and LIST_POISON2, respectively.\n\nIf later we end up calling drop_delayed_ref() against the ref, which can\nhappen during merging or when destroying delayed refs due to a transaction\nabort, we can trigger a crash since at drop_delayed_ref() we call\nlist_empty() against the ref\u0027s add_list, which returns false since\nthe list was not reinitialized after the list_del() and as a consequence\nwe call list_del() again at drop_delayed_ref(). This results in an\ninvalid list access since the next and prev members are set to poison\npointers, resulting in a splat if CONFIG_LIST_HARDENED and\nCONFIG_DEBUG_LIST are set or invalid poison pointer dereferences\notherwise.\n\nSo fix this by deleting from the list with list_del_init() instead."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-05-04T09:50:28.471Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/2fd0948a483e9cb2d669c7199bc620a21c97673d"
            },
            {
              "url": "https://git.kernel.org/stable/c/93c5b8decc0ef39ba84f4211d2db6da0a4aefbeb"
            },
            {
              "url": "https://git.kernel.org/stable/c/bf0b0c6d159767c0d1c21f793950d78486690ee0"
            },
            {
              "url": "https://git.kernel.org/stable/c/c24fa427fc0ae827b2a3a07f13738cbf82c3f851"
            },
            {
              "url": "https://git.kernel.org/stable/c/2cb1a73d1d44a1c11b0ee5eeced765dd80ec48e6"
            },
            {
              "url": "https://git.kernel.org/stable/c/f04be6d68f715c1473a8422fc0460f57b5e99931"
            },
            {
              "url": "https://git.kernel.org/stable/c/50a3933760b427759afdd23156a7280a19357a92"
            },
            {
              "url": "https://git.kernel.org/stable/c/c9a75ec45f1111ef530ab186c2a7684d0a0c9245"
            }
          ],
          "title": "btrfs: reinitialize delayed ref list after deleting it from the list",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2024-50273",
        "datePublished": "2024-11-19T01:30:12.589Z",
        "dateReserved": "2024-10-21T19:36:19.983Z",
        "dateUpdated": "2025-11-03T22:27:54.002Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.