Description
In the Linux kernel, the following vulnerability has been resolved:
btrfs: add a sanity check for btrfs root in btrfs_search_slot()
Syzbot reports a null-ptr-deref in btrfs_search_slot().
The reproducer is using rescue=ibadroots, and the extent tree root is
corrupted thus the extent tree is NULL.
When scrub tries to search the extent tree to gather the needed extent
info, btrfs_search_slot() doesn't check if the target root is NULL or
not, resulting the null-ptr-deref.
Add sanity check for btrfs root before using it in btrfs_search_slot().
btrfs: add a sanity check for btrfs root in btrfs_search_slot()
Syzbot reports a null-ptr-deref in btrfs_search_slot().
The reproducer is using rescue=ibadroots, and the extent tree root is
corrupted thus the extent tree is NULL.
When scrub tries to search the extent tree to gather the needed extent
info, btrfs_search_slot() doesn't check if the target root is NULL or
not, resulting the null-ptr-deref.
Add sanity check for btrfs root before using it in btrfs_search_slot().
Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux | unaffected |
|
||||||||||||||||||||||||
| Linux | Linux | affected |
|
Configuration 1 [-]
|
No data.
No data available yet.
Remediation
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 Debian DLA |
DLA-4076-1 | linux-6.1 security update |
 EUVD |
EUVD-2024-53417 | In the Linux kernel, the following vulnerability has been resolved: btrfs: add a sanity check for btrfs root in btrfs_search_slot() Syzbot reports a null-ptr-deref in btrfs_search_slot(). The reproducer is using rescue=ibadroots, and the extent tree root is corrupted thus the extent tree is NULL. When scrub tries to search the extent tree to gather the needed extent info, btrfs_search_slot() doesn't check if the target root is NULL or not, resulting the null-ptr-deref. Add sanity check for btrfs root before using it in btrfs_search_slot(). |
 Ubuntu USN |
USN-7379-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-7379-2 | Linux kernel (Raspberry Pi) vulnerabilities |
| Ubuntu USN |
USN-7380-1 | Linux kernel (Low Latency) vulnerabilities |
| Ubuntu USN |
USN-7381-1 | Linux kernel (Low Latency) vulnerabilities |
| Ubuntu USN |
USN-7382-1 | Linux kernel (OEM) vulnerabilities |
| Ubuntu USN |
USN-7387-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-7387-2 | Linux kernel (FIPS) vulnerabilities |
| Ubuntu USN |
USN-7387-3 | Linux kernel (Real-time) vulnerabilities |
| Ubuntu USN |
USN-7388-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-7389-1 | Linux kernel (NVIDIA Tegra) vulnerabilities |
| Ubuntu USN |
USN-7390-1 | Linux kernel (Xilinx ZynqMP) vulnerabilities |
| Ubuntu USN |
USN-7407-1 | Linux kernel (HWE) vulnerabilities |
| Ubuntu USN |
USN-7421-1 | Linux kernel (Azure) vulnerabilities |
| Ubuntu USN |
USN-7449-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-7449-2 | Linux kernel (HWE) vulnerabilities |
| Ubuntu USN |
USN-7450-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-7451-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-7452-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-7453-1 | Linux kernel (Real-time) vulnerabilities |
| Ubuntu USN |
USN-7458-1 | Linux kernel (IBM) vulnerabilities |
| Ubuntu USN |
USN-7459-1 | Linux kernel (Intel IoTG) vulnerabilities |
| Ubuntu USN |
USN-7459-2 | Linux kernel (GCP) vulnerabilities |
| Ubuntu USN |
USN-7468-1 | Linux kernel (Azure, N-Series) vulnerabilities |
| Ubuntu USN |
USN-7523-1 | Linux kernel (Raspberry Pi Real-time) vulnerabilities |
| Ubuntu USN |
USN-7524-1 | Linux kernel (Raspberry Pi) vulnerabilities |
References
History
Mon, 03 Nov 2025 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Wed, 01 Oct 2025 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 13 Feb 2025 01:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
threat_severity
|
threat_severity
|
Fri, 10 Jan 2025 01:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Thu, 09 Jan 2025 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Linux
Linux linux Kernel |
|
| Weaknesses | CWE-476 | |
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:* |
|
| Vendors & Products |
Linux
Linux linux Kernel |
|
| Metrics |
cvssV3_1
|
Wed, 08 Jan 2025 18:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: btrfs: add a sanity check for btrfs root in btrfs_search_slot() Syzbot reports a null-ptr-deref in btrfs_search_slot(). The reproducer is using rescue=ibadroots, and the extent tree root is corrupted thus the extent tree is NULL. When scrub tries to search the extent tree to gather the needed extent info, btrfs_search_slot() doesn't check if the target root is NULL or not, resulting the null-ptr-deref. Add sanity check for btrfs root before using it in btrfs_search_slot(). | |
| Title | btrfs: add a sanity check for btrfs root in btrfs_search_slot() | |
| References |
|
|
MITRE
Status: PUBLISHED
Assigner: Linux
Published:
Updated: 2026-05-11T20:58:48.797Z
Reserved: 2024-12-29T11:26:39.766Z
Link: CVE-2024-56774
Vulnrichment
Updated: 2025-10-01T15:50:45.453Z
NVD
Status : Modified
Published: 2025-01-08T18:15:18.213
Modified: 2025-11-03T21:18:30.110
Link: CVE-2024-56774
Redhat
OpenCVE Enrichment
No data.
Weaknesses