Withdrawn: this CVE is not a vulnerability
The assigning CNA withdrew CVE-2024-26794 on 15 October 2026, and it carries the Rejected state at CVE.org and NVD. It must not be treated as a live finding. Its pre-withdrawal severity, score and exploitability are withheld below; the record itself is kept because withdrawals are reversible and because the reject reason is the correction worth publishing.
WITHDRAWN
CVE-2024-26794
Btrfs fiemap race vulnerability
Overview
Description
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Details
INFO
Published Date :
April 4, 2024, 9:15 a.m.
Last Modified :
Oct. 15, 2026, 8:10 p.m.
Remotely Exploit :
—
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2024-26794 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2024-26794 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 15, 2026
Action Type Old Value New Value Changed Translation Title: kernel de Linux, Description: En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: corrige la ejecución entre la finalización de extensión ordenada y fiemap Para fiemap recientemente dejamos de bloquear el rango de extensión objetivo durante toda la duración de la llamada a fiemap, para evitar un punto muerto en un escenario donde el búfer fiemap resulta ser un rango mapeado en memoria del mismo archivo. Es muy poco probable que este caso de uso sea útil en la práctica, pero puede activarse mediante pruebas difusas (syzbot, etc.). Sin embargo, al no bloquear el rango de extensión objetivo durante toda la duración de la llamada a fiemap, podemos competir con una extensión ordenada. Esto sucede así: 1) La tarea fiemap termina de procesar un elemento de extensión de archivo que cubre el rango de archivos [512K, 1M[, y ese elemento de extensión de archivo es el último elemento de la hoja que se está procesando actualmente; 2) Y la extensión ordenada para el rango de archivos [768K, 2M[, en modo COW, se completa (btrfs_finish_one_ordered()) y el elemento de extensión de archivo que cubre el rango [512K, 1M[ se recorta para cubrir el rango [512K, 768K[ y luego se inserta un nuevo elemento de extensión de archivo para el rango [768K, 2M[ en el árbol de subvolumen del inodo; 3) La tarea fiemap llama a fiemap_next_leaf_item(), que luego llama a btrfs_next_leaf() para encontrar la siguiente hoja/elemento. Esto encuentra que la siguiente clave después de la que procesamos anteriormente (su tipo es BTRFS_EXTENT_DATA_KEY y su desplazamiento es 512K), es la clave correspondiente al nuevo elemento de extensión de archivo insertado por la extensión ordenada, que tiene un tipo de BTRFS_EXTENT_DATA_KEY y un desplazamiento de 768K; 4) Más tarde, el código fiemap termina en emit_fiemap_extent() y activa la advertencia: if (cache->offset + cache->len > offset) { WARN_ON(1); devolver -EINVAL; } Dado que obtenemos 1M > 768K, porque la entrada emitida previamente para la extensión anterior que cubre el rango de archivos [512K, 1M[ termina en un desplazamiento que es mayor que el desplazamiento inicial de la nueva extensión (768K). Esto hace que fiemap falle con -EINVAL además de activar la advertencia que produce un seguimiento de pila como el siguiente: [1621.677651] ------------[ cortar aquí ]----------- - [1621.677656] ADVERTENCIA: CPU: 1 PID: 204366 en fs/btrfs/extent_io.c:2492 emit_fiemap_extent+0x84/0x90 [btrfs] [1621.677899] Módulos vinculados en: btrfs blake2b_generic (...) [1621.677951] CPU: 1 PID: 204366 Comm: pool No contaminado 6.8.0-rc5-btrfs-next-151+ #1 [1621.677954] Nombre del hardware: PC estándar QEMU (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390- prebuilt.qemu.org 01/04/2014 [1621.677956] RIP: 0010:emit_fiemap_extent+0x84/0x90 [btrfs] [1621.678033] Código: 2b 4c 89 63 (...) [1621.678035] RSP: 0018:ffffab160 89ffd20 EFLAGS: 00010206 [1621.678037] RAX: 00000000004fa000 RBX: ffffab16089ffe08 RCX: 0000000000009000 [1621.678039] RDX: 00000000004f9000 RSI: 00000000004f1000 RDI : ffffab16089ffe90 [1621.678040] RBP: 00000000004f9000 R08: 0000000000001000 R09: 00000000000000000 [1621.678041] R10: 0000000000000000 R11 : 0000000000001000 R12: 0000000041d78000 [1621.678043 ] R13: 0000000000001000 R14: 00000000000000000 R15: ffff9434f0b17850 [1621.678044] FS: 00007fa6e20006c0(0000) GS:ffff943bdfa40000(0000) kn lGS:0000000000000000 [1621.678046] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [1621.678048] CR2: 00007fa6b0801000 CR3 : 000000012d404002 CR4: 0000000000370ef0 [1621.678053] DR0: 0000000000000000 DR1: 00000000000000000 DR2: 0000000000000000 [1621.678055] DR 3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [1621.678056] Seguimiento de llamadas: [1621.678074] [1621.678076] ? __advertir+0x80/0x130 [1621.678082] ? emit_fiemap_extent+0x84/0x90 [btrfs] [1621.678159] ? report_bug+0x1f4/0x200 [1621.678164] ? ---truncado--- Title: rechazado, Description: Motivo del rechazo: Este ID de CVE ha sido rechazado o retirado por su Autoridad de Numeración de CVE (CNA). -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 19, 2025
Action Type Old Value New Value Changed Description In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between ordered extent completion and fiemap For fiemap we recently stopped locking the target extent range for the whole duration of the fiemap call, in order to avoid a deadlock in a scenario where the fiemap buffer happens to be a memory mapped range of the same file. This use case is very unlikely to be useful in practice but it may be triggered by fuzz testing (syzbot, etc). However by not locking the target extent range for the whole duration of the fiemap call we can race with an ordered extent. This happens like this: 1) The fiemap task finishes processing a file extent item that covers the file range [512K, 1M[, and that file extent item is the last item in the leaf currently being processed; 2) And ordered extent for the file range [768K, 2M[, in COW mode, completes (btrfs_finish_one_ordered()) and the file extent item covering the range [512K, 1M[ is trimmed to cover the range [512K, 768K[ and then a new file extent item for the range [768K, 2M[ is inserted in the inode's subvolume tree; 3) The fiemap task calls fiemap_next_leaf_item(), which then calls btrfs_next_leaf() to find the next leaf / item. This finds that the the next key following the one we previously processed (its type is BTRFS_EXTENT_DATA_KEY and its offset is 512K), is the key corresponding to the new file extent item inserted by the ordered extent, which has a type of BTRFS_EXTENT_DATA_KEY and an offset of 768K; 4) Later the fiemap code ends up at emit_fiemap_extent() and triggers the warning: if (cache->offset + cache->len > offset) { WARN_ON(1); return -EINVAL; } Since we get 1M > 768K, because the previously emitted entry for the old extent covering the file range [512K, 1M[ ends at an offset that is greater than the new extent's start offset (768K). This makes fiemap fail with -EINVAL besides triggering the warning that produces a stack trace like the following: [1621.677651] ------------[ cut here ]------------ [1621.677656] WARNING: CPU: 1 PID: 204366 at fs/btrfs/extent_io.c:2492 emit_fiemap_extent+0x84/0x90 [btrfs] [1621.677899] Modules linked in: btrfs blake2b_generic (...) [1621.677951] CPU: 1 PID: 204366 Comm: pool Not tainted 6.8.0-rc5-btrfs-next-151+ #1 [1621.677954] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [1621.677956] RIP: 0010:emit_fiemap_extent+0x84/0x90 [btrfs] [1621.678033] Code: 2b 4c 89 63 (...) [1621.678035] RSP: 0018:ffffab16089ffd20 EFLAGS: 00010206 [1621.678037] RAX: 00000000004fa000 RBX: ffffab16089ffe08 RCX: 0000000000009000 [1621.678039] RDX: 00000000004f9000 RSI: 00000000004f1000 RDI: ffffab16089ffe90 [1621.678040] RBP: 00000000004f9000 R08: 0000000000001000 R09: 0000000000000000 [1621.678041] R10: 0000000000000000 R11: 0000000000001000 R12: 0000000041d78000 [1621.678043] R13: 0000000000001000 R14: 0000000000000000 R15: ffff9434f0b17850 [1621.678044] FS: 00007fa6e20006c0(0000) GS:ffff943bdfa40000(0000) knlGS:0000000000000000 [1621.678046] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [1621.678048] CR2: 00007fa6b0801000 CR3: 000000012d404002 CR4: 0000000000370ef0 [1621.678053] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [1621.678055] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [1621.678056] Call Trace: [1621.678074] <TASK> [1621.678076] ? __warn+0x80/0x130 [1621.678082] ? emit_fiemap_extent+0x84/0x90 [btrfs] [1621.678159] ? report_bug+0x1f4/0x200 [1621.678164] ? handle_bug+0x42/0x70 [1621.678167] ? exc_invalid_op+0x14/0x70 [1621.678170] ? asm_exc_invalid_op+0x16/0x20 [1621.678178] ? emit_fiemap_extent+0x84/0x90 [btrfs] [1621.678253] extent_fiemap+0x766 ---truncated--- Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Removed CVSS V3.1 CISA-ADP: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Removed CWE NIST: CWE-362 Removed CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:6.7.12:*:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.6.24:*:*:*:*:*:*:* Removed Reference kernel.org: https://git.kernel.org/stable/c/31d07a757c6d3430e03cc22799921569999b9a12 Removed Reference kernel.org: https://git.kernel.org/stable/c/a1a4a9ca77f143c00fce69c1239887ff8b813bec Removed Reference kernel.org: https://git.kernel.org/stable/c/d43f8e58f10a44df8c08e7f7076f3288352cd168 Removed Reference CVE: https://git.kernel.org/stable/c/31d07a757c6d3430e03cc22799921569999b9a12 Removed Reference CVE: https://git.kernel.org/stable/c/a1a4a9ca77f143c00fce69c1239887ff8b813bec Removed Reference CVE: https://git.kernel.org/stable/c/d43f8e58f10a44df8c08e7f7076f3288352cd168 Removed Reference Type kernel.org: https://git.kernel.org/stable/c/31d07a757c6d3430e03cc22799921569999b9a12 Types: Patch Removed Reference Type kernel.org: https://git.kernel.org/stable/c/a1a4a9ca77f143c00fce69c1239887ff8b813bec Types: Patch Removed Reference Type kernel.org: https://git.kernel.org/stable/c/d43f8e58f10a44df8c08e7f7076f3288352cd168 Types: Patch Removed Reference Type CVE: https://git.kernel.org/stable/c/31d07a757c6d3430e03cc22799921569999b9a12 Types: Patch Removed Reference Type CVE: https://git.kernel.org/stable/c/a1a4a9ca77f143c00fce69c1239887ff8b813bec Types: Patch Removed Reference Type CVE: https://git.kernel.org/stable/c/d43f8e58f10a44df8c08e7f7076f3288352cd168 Types: Patch -
CVE Rejected by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 19, 2025
Action Type Old Value New Value -
Initial Analysis by [email protected]
Apr. 04, 2025
Action Type Old Value New Value Added CWE CWE-362 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:6.7.12:*:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.6.24:*:*:*:*:*:*:* Added Reference Type CVE: https://git.kernel.org/stable/c/31d07a757c6d3430e03cc22799921569999b9a12 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/31d07a757c6d3430e03cc22799921569999b9a12 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/a1a4a9ca77f143c00fce69c1239887ff8b813bec Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/a1a4a9ca77f143c00fce69c1239887ff8b813bec Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/d43f8e58f10a44df8c08e7f7076f3288352cd168 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d43f8e58f10a44df8c08e7f7076f3288352cd168 Types: Patch -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/31d07a757c6d3430e03cc22799921569999b9a12 Added Reference https://git.kernel.org/stable/c/a1a4a9ca77f143c00fce69c1239887ff8b813bec Added Reference https://git.kernel.org/stable/c/d43f8e58f10a44df8c08e7f7076f3288352cd168 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Nov. 07, 2024
Action Type Old Value New Value Added CVSS V3.1 CISA-ADP AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 29, 2024
Action Type Old Value New Value -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 14, 2024
Action Type Old Value New Value -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 04, 2024
Action Type Old Value New Value Added Reference kernel.org https://git.kernel.org/stable/c/a1a4a9ca77f143c00fce69c1239887ff8b813bec [No types assigned] -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 04, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between ordered extent completion and fiemap For fiemap we recently stopped locking the target extent range for the whole duration of the fiemap call, in order to avoid a deadlock in a scenario where the fiemap buffer happens to be a memory mapped range of the same file. This use case is very unlikely to be useful in practice but it may be triggered by fuzz testing (syzbot, etc). However by not locking the target extent range for the whole duration of the fiemap call we can race with an ordered extent. This happens like this: 1) The fiemap task finishes processing a file extent item that covers the file range [512K, 1M[, and that file extent item is the last item in the leaf currently being processed; 2) And ordered extent for the file range [768K, 2M[, in COW mode, completes (btrfs_finish_one_ordered()) and the file extent item covering the range [512K, 1M[ is trimmed to cover the range [512K, 768K[ and then a new file extent item for the range [768K, 2M[ is inserted in the inode's subvolume tree; 3) The fiemap task calls fiemap_next_leaf_item(), which then calls btrfs_next_leaf() to find the next leaf / item. This finds that the the next key following the one we previously processed (its type is BTRFS_EXTENT_DATA_KEY and its offset is 512K), is the key corresponding to the new file extent item inserted by the ordered extent, which has a type of BTRFS_EXTENT_DATA_KEY and an offset of 768K; 4) Later the fiemap code ends up at emit_fiemap_extent() and triggers the warning: if (cache->offset + cache->len > offset) { WARN_ON(1); return -EINVAL; } Since we get 1M > 768K, because the previously emitted entry for the old extent covering the file range [512K, 1M[ ends at an offset that is greater than the new extent's start offset (768K). This makes fiemap fail with -EINVAL besides triggering the warning that produces a stack trace like the following: [1621.677651] ------------[ cut here ]------------ [1621.677656] WARNING: CPU: 1 PID: 204366 at fs/btrfs/extent_io.c:2492 emit_fiemap_extent+0x84/0x90 [btrfs] [1621.677899] Modules linked in: btrfs blake2b_generic (...) [1621.677951] CPU: 1 PID: 204366 Comm: pool Not tainted 6.8.0-rc5-btrfs-next-151+ #1 [1621.677954] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [1621.677956] RIP: 0010:emit_fiemap_extent+0x84/0x90 [btrfs] [1621.678033] Code: 2b 4c 89 63 (...) [1621.678035] RSP: 0018:ffffab16089ffd20 EFLAGS: 00010206 [1621.678037] RAX: 00000000004fa000 RBX: ffffab16089ffe08 RCX: 0000000000009000 [1621.678039] RDX: 00000000004f9000 RSI: 00000000004f1000 RDI: ffffab16089ffe90 [1621.678040] RBP: 00000000004f9000 R08: 0000000000001000 R09: 0000000000000000 [1621.678041] R10: 0000000000000000 R11: 0000000000001000 R12: 0000000041d78000 [1621.678043] R13: 0000000000001000 R14: 0000000000000000 R15: ffff9434f0b17850 [1621.678044] FS: 00007fa6e20006c0(0000) GS:ffff943bdfa40000(0000) knlGS:0000000000000000 [1621.678046] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [1621.678048] CR2: 00007fa6b0801000 CR3: 000000012d404002 CR4: 0000000000370ef0 [1621.678053] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [1621.678055] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [1621.678056] Call Trace: [1621.678074] <TASK> [1621.678076] ? __warn+0x80/0x130 [1621.678082] ? emit_fiemap_extent+0x84/0x90 [btrfs] [1621.678159] ? report_bug+0x1f4/0x200 [1621.678164] ? handle_bug+0x42/0x70 [1621.678167] ? exc_invalid_op+0x14/0x70 [1621.678170] ? asm_exc_invalid_op+0x16/0x20 [1621.678178] ? emit_fiemap_extent+0x84/0x90 [btrfs] [1621.678253] extent_fiemap+0x766 ---truncated--- Added Reference kernel.org https://git.kernel.org/stable/c/d43f8e58f10a44df8c08e7f7076f3288352cd168 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/31d07a757c6d3430e03cc22799921569999b9a12 [No types assigned]
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.