{"id":"CVE-2024-44963","title":"btrfs: do not BUG_ON() when freeing tree block after error","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not BUG_ON() when freeing tree block after error\n\nWhen freeing a tree block, at btrfs_free_tree_block(), if we fail to\ncreate a delayed reference we don't dea…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= fb235dc06fac9eaa4408ade9c8b20d45d63c89b7 < bfcef12f80b3a9bd6b09c7305679164e3307328a","Linux >= fb235dc06fac9eaa4408ade9c8b20d45d63c89b7 < 22d907bcd283d69d5e60497fc0d51969545c583b","Linux >= fb235dc06fac9eaa4408ade9c8b20d45d63c89b7 < 98251cd60b4d702a8a81de442ab621e83a3fb24f","Linux >= fb235dc06fac9eaa4408ade9c8b20d45d63c89b7 < bb3868033a4cccff7be57e9145f2117cbdc91c11","Linux 4.11"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2024-09-10T17:39:41.059166Z"},"published":"2024-09-04","updated":"2026-10-30","sourceUpdated":"2026-10-30T12:19:11.923Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-44963","references":[{"url":"https://git.kernel.org/stable/c/bfcef12f80b3a9bd6b09c7305679164e3307328a"},{"url":"https://git.kernel.org/stable/c/22d907bcd283d69d5e60497fc0d51969545c583b"},{"url":"https://git.kernel.org/stable/c/98251cd60b4d702a8a81de442ab621e83a3fb24f"},{"url":"https://git.kernel.org/stable/c/bb3868033a4cccff7be57e9145f2117cbdc91c11"}],"tags":["cve.org"],"epss":0.00241,"epssPercentile":0.15275,"ingestedAt":"2026-11-03T13:45:42.690Z","slug":"CVE-2024-44963","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not BUG_ON() when freeing tree block after error\n\nWhen freeing a tree block, at btrfs_free_tree_block(), if we fail to\ncreate a delayed reference we don't deal with the error and just do a\nBUG_ON(). The error most likely to happen is -ENOMEM, and we have a\ncomment mentioning that only -ENOMEM can happen, but that is not true,\nbecause in case qgroups are enabled any error returned from\nbtrfs_qgroup_trace_extent_post() (can be -EUCLEAN or anything returned\nfrom btrfs_search_slot() for example) can be propagated back to\nbtrfs_free_tree_block().\n\nSo stop doing a BUG_ON() and return the error to the callers and make\nthem abort the transaction to prevent leaking space. Syzbot was\ntriggering this, likely due to memory allocation failure injection.\n\n## Affected\n\n- `Linux >= fb235dc06fac9eaa4408ade9c8b20d45d63c89b7 < bfcef12f80b3a9bd6b09c7305679164e3307328a`\n- `Linux >= fb235dc06fac9eaa4408ade9c8b20d45d63c89b7 < 22d907bcd283d69d5e60497fc0d51969545c583b`\n- `Linux >= fb235dc06fac9eaa4408ade9c8b20d45d63c89b7 < 98251cd60b4d702a8a81de442ab621e83a3fb24f`\n- `Linux >= fb235dc06fac9eaa4408ade9c8b20d45d63c89b7 < bb3868033a4cccff7be57e9145f2117cbdc91c11`\n- `Linux 4.11`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}