---
id: CVE-2024-44963
title: 'btrfs: do not BUG_ON() when freeing tree block after error'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  btrfs: do not BUG_ON() when freeing tree block after error

  When freeing a tree block, at btrfs_free_tree_block(), if we fail to
  create a delayed reference we don't dea…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= fb235dc06fac9eaa4408ade9c8b20d45d63c89b7 <
    bfcef12f80b3a9bd6b09c7305679164e3307328a
  - >-
    Linux >= fb235dc06fac9eaa4408ade9c8b20d45d63c89b7 <
    22d907bcd283d69d5e60497fc0d51969545c583b
  - >-
    Linux >= fb235dc06fac9eaa4408ade9c8b20d45d63c89b7 <
    98251cd60b4d702a8a81de442ab621e83a3fb24f
  - >-
    Linux >= fb235dc06fac9eaa4408ade9c8b20d45d63c89b7 <
    bb3868033a4cccff7be57e9145f2117cbdc91c11
  - Linux 4.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2024-09-10T17:39:41.059166Z'
published: '2024-09-04'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:19:11.923Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2024-44963'
references:
  - url: 'https://git.kernel.org/stable/c/bfcef12f80b3a9bd6b09c7305679164e3307328a'
  - url: 'https://git.kernel.org/stable/c/22d907bcd283d69d5e60497fc0d51969545c583b'
  - url: 'https://git.kernel.org/stable/c/98251cd60b4d702a8a81de442ab621e83a3fb24f'
  - url: 'https://git.kernel.org/stable/c/bb3868033a4cccff7be57e9145f2117cbdc91c11'
tags:
  - cve.org
epss: 0.00241
epssPercentile: 0.15275
ingestedAt: '2026-11-03T13:45:42.690Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

btrfs: do not BUG_ON() when freeing tree block after error

When freeing a tree block, at btrfs_free_tree_block(), if we fail to
create a delayed reference we don't deal with the error and just do a
BUG_ON(). The error most likely to happen is -ENOMEM, and we have a
comment mentioning that only -ENOMEM can happen, but that is not true,
because in case qgroups are enabled any error returned from
btrfs_qgroup_trace_extent_post() (can be -EUCLEAN or anything returned
from btrfs_search_slot() for example) can be propagated back to
btrfs_free_tree_block().

So stop doing a BUG_ON() and return the error to the callers and make
them abort the transaction to prevent leaking space. Syzbot was
triggering this, likely due to memory allocation failure injection.

## Affected

- `Linux >= fb235dc06fac9eaa4408ade9c8b20d45d63c89b7 < bfcef12f80b3a9bd6b09c7305679164e3307328a`
- `Linux >= fb235dc06fac9eaa4408ade9c8b20d45d63c89b7 < 22d907bcd283d69d5e60497fc0d51969545c583b`
- `Linux >= fb235dc06fac9eaa4408ade9c8b20d45d63c89b7 < 98251cd60b4d702a8a81de442ab621e83a3fb24f`
- `Linux >= fb235dc06fac9eaa4408ade9c8b20d45d63c89b7 < bb3868033a4cccff7be57e9145f2117cbdc91c11`
- `Linux 4.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.