GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-44972 (GCVE-0-2024-44972)

Vulnerability from cvelistv5 – Published: 2024-09-04 18:56 – Updated: 2026-01-05 11:10
VLAI

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2026-01-05T11:10:47.949Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-44972",
    "datePublished": "2024-09-04T18:56:48.145Z",
    "dateRejected": "2026-01-05T11:10:47.949Z",
    "dateReserved": "2024-08-21T05:34:56.669Z",
    "dateUpdated": "2026-01-05T11:10:47.949Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.6.46\", \"matchCriteriaId\": \"84C35A98-08C9-4674-8AC8-9CC0757B7699\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.5\", \"matchCriteriaId\": \"D074AE50-4A5E-499C-A2FD-75FD60DEA560\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: do not clear page dirty inside extent_write_locked_range()\\n\\n[BUG]\\nFor subpage + zoned case, the following workload can lead to rsv data\\nleak at unmount time:\\n\\n  # mkfs.btrfs -f -s 4k $dev\\n  # mount $dev $mnt\\n  # fsstress -w -n 8 -d $mnt -s 1709539240\\n  0/0: fiemap - no filename\\n  0/1: copyrange read - no filename\\n  0/2: write - no filename\\n  0/3: rename - no source filename\\n  0/4: creat f0 x:0 0 0\\n  0/4: creat add id=0,parent=-1\\n  0/5: writev f0[259 1 0 0 0 0] [778052,113,965] 0\\n  0/6: ioctl(FIEMAP) f0[259 1 0 0 224 887097] [1294220,2291618343991484791,0x10000] -1\\n  0/7: dwrite - xfsctl(XFS_IOC_DIOINFO) f0[259 1 0 0 224 887097] return 25, fallback to stat()\\n  0/7: dwrite f0[259 1 0 0 224 887097] [696320,102400] 0\\n  # umount $mnt\\n\\nThe dmesg includes the following rsv leak detection warning (all call\\ntrace skipped):\\n\\n  ------------[ cut here ]------------\\n  WARNING: CPU: 2 PID: 4528 at fs/btrfs/inode.c:8653 btrfs_destroy_inode+0x1e0/0x200 [btrfs]\\n  ---[ end trace 0000000000000000 ]---\\n  ------------[ cut here ]------------\\n  WARNING: CPU: 2 PID: 4528 at fs/btrfs/inode.c:8654 btrfs_destroy_inode+0x1a8/0x200 [btrfs]\\n  ---[ end trace 0000000000000000 ]---\\n  ------------[ cut here ]------------\\n  WARNING: CPU: 2 PID: 4528 at fs/btrfs/inode.c:8660 btrfs_destroy_inode+0x1a0/0x200 [btrfs]\\n  ---[ end trace 0000000000000000 ]---\\n  BTRFS info (device sda): last unmount of filesystem 1b4abba9-de34-4f07-9e7f-157cf12a18d6\\n  ------------[ cut here ]------------\\n  WARNING: CPU: 3 PID: 4528 at fs/btrfs/block-group.c:4434 btrfs_free_block_groups+0x338/0x500 [btrfs]\\n  ---[ end trace 0000000000000000 ]---\\n  BTRFS info (device sda): space_info DATA has 268218368 free, is not full\\n  BTRFS info (device sda): space_info total=268435456, used=204800, pinned=0, reserved=0, may_use=12288, readonly=0 zone_unusable=0\\n  BTRFS info (device sda): global_block_rsv: size 0 reserved 0\\n  BTRFS info (device sda): trans_block_rsv: size 0 reserved 0\\n  BTRFS info (device sda): chunk_block_rsv: size 0 reserved 0\\n  BTRFS info (device sda): delayed_block_rsv: size 0 reserved 0\\n  BTRFS info (device sda): delayed_refs_rsv: size 0 reserved 0\\n  ------------[ cut here ]------------\\n  WARNING: CPU: 3 PID: 4528 at fs/btrfs/block-group.c:4434 btrfs_free_block_groups+0x338/0x500 [btrfs]\\n  ---[ end trace 0000000000000000 ]---\\n  BTRFS info (device sda): space_info METADATA has 267796480 free, is not full\\n  BTRFS info (device sda): space_info total=268435456, used=131072, pinned=0, reserved=0, may_use=262144, readonly=0 zone_unusable=245760\\n  BTRFS info (device sda): global_block_rsv: size 0 reserved 0\\n  BTRFS info (device sda): trans_block_rsv: size 0 reserved 0\\n  BTRFS info (device sda): chunk_block_rsv: size 0 reserved 0\\n  BTRFS info (device sda): delayed_block_rsv: size 0 reserved 0\\n  BTRFS info (device sda): delayed_refs_rsv: size 0 reserved 0\\n\\nAbove $dev is a tcmu-runner emulated zoned HDD, which has a max zone\\nappend size of 64K, and the system has 64K page size.\\n\\n[CAUSE]\\nI have added several trace_printk() to show the events (header skipped):\\n\\n  \u003e btrfs_dirty_pages: r/i=5/259 dirty start=774144 len=114688\\n  \u003e btrfs_dirty_pages: r/i=5/259 dirty part of page=720896 off_in_page=53248 len_in_page=12288\\n  \u003e btrfs_dirty_pages: r/i=5/259 dirty part of page=786432 off_in_page=0 len_in_page=65536\\n  \u003e btrfs_dirty_pages: r/i=5/259 dirty part of page=851968 off_in_page=0 len_in_page=36864\\n\\nThe above lines show our buffered write has dirtied 3 pages of inode\\n259 of root 5:\\n\\n  704K             768K              832K              896K\\n  I           |////I/////////////////I///////////|     I\\n              756K                               868K\\n\\n  |///| is the dirtied range using subpage bitmaps. and \u0027I\u0027 is the page\\n  boundary.\\n\\n  Meanwhile all three pages (704K, 768K, 832K) have their PageDirty\\n  flag set.\\n\\n  \u003e btrfs_direct_write: r/i=5/259 start dio filepos=696320 len=102400\\n\\nThen direct IO writ\\n---truncated---\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: no borrar la p\\u00e1gina sucia dentro de extended_write_locked_range() [ERROR] Para el caso de subp\\u00e1gina + zonificaci\\u00f3n, la siguiente carga de trabajo puede provocar una fuga de datos de rsv en el momento del desmontaje: # mkfs.btrfs -f -s 4k $dev # mount $dev $mnt # fsstress -w -n 8 -d $mnt -s 1709539240 0/0: fiemap - sin nombre de archivo 0/1: copyrange read - sin nombre de archivo 0/2: write - sin nombre de archivo 0/3: rename - sin nombre de archivo de origen 0/4: creat f0 x:0 0 0 0/4: creat add id=0,parent=-1 0/5: writev f0[259 1 0 0 0 0] [778052,113,965] 0 0/6: ioctl(FIEMAP) f0[259 1 0 0 224 887097] [1294220,2291618343991484791,0x10000] -1 0/7: dwrite - xfsctl(XFS_IOC_DIOINFO) f0[259 1 0 0 224 887097] return 25, fallback to stat() 0/7: dwrite f0[259 1 0 0 224 887097] [696320,102400] 0 # umount $mnt El dmesg incluye la siguiente advertencia de detecci\\u00f3n de fugas de rsv (se omite todo el seguimiento de llamadas): ------------[ cortar aqu\\u00ed ]------------ ADVERTENCIA: CPU: 2 PID: 4528 en fs/btrfs/inode.c:8653 btrfs_destroy_inode+0x1e0/0x200 [btrfs] ---[ fin del seguimiento 000000000000000 ]--- ------------[ cortar aqu\\u00ed ]------------ ADVERTENCIA: CPU: 2 PID: 4528 en fs/btrfs/inode.c:8654 btrfs_destroy_inode+0x1a8/0x200 [btrfs] ---[ fin del seguimiento 000000000000000 ]--- ------------[ cortar aqu\\u00ed ]------------ ADVERTENCIA: CPU: 2 PID: 4528 en fs/btrfs/inode.c:8660 btrfs_destroy_inode+0x1a0/0x200 [btrfs] ---[ fin del seguimiento 000000000000000 ]--- Informaci\\u00f3n de BTRFS (dispositivo sda): \\u00faltimo desmontaje del sistema de archivos 1b4abba9-de34-4f07-9e7f-157cf12a18d6 ------------[ cortar aqu\\u00ed ]------------ ADVERTENCIA: CPU: 3 PID: 4528 en fs/btrfs/block-group.c:4434 btrfs_free_block_groups+0x338/0x500 [btrfs] ---[ fin del seguimiento 000000000000000 ]--- Informaci\\u00f3n de BTRFS (dispositivo sda): space_info DATA tiene 268218368 libres, no est\\u00e1 lleno Informaci\\u00f3n de BTRFS (dispositivo sda): space_info total=268435456, used=204800, pinned=0, reserved=0, may_use=12288, readonly=0 zone_unusable=0 BTRFS informaci\\u00f3n (dispositivo sda): global_block_rsv: tama\\u00f1o 0 reservado 0 informaci\\u00f3n BTRFS (dispositivo sda): trans_block_rsv: tama\\u00f1o 0 reservado 0 informaci\\u00f3n BTRFS (dispositivo sda): chunk_block_rsv: tama\\u00f1o 0 reservado 0 informaci\\u00f3n BTRFS (dispositivo sda): delayed_block_rsv: tama\\u00f1o 0 reservado 0 informaci\\u00f3n BTRFS (dispositivo sda): delayed_refs_rsv: tama\\u00f1o 0 reservado 0 ------------[ cortar aqu\\u00ed ]------------ ADVERTENCIA: CPU: 3 PID: 4528 en fs/btrfs/block-group.c:4434 btrfs_free_block_groups+0x338/0x500 [btrfs] ---[ fin de seguimiento 000000000000000 ]--- informaci\\u00f3n BTRFS (dispositivo sda): space_info METADATA tiene 267796480 libres, es Informaci\\u00f3n BTRFS no completa (dispositivo sda): space_info total=268435456, used=131072, pinned=0, reserved=0, may_use=262144, readonly=0 zone_unusable=245760 Informaci\\u00f3n BTRFS (dispositivo sda): global_block_rsv: tama\\u00f1o 0 reservado 0 Informaci\\u00f3n BTRFS (dispositivo sda): trans_block_rsv: tama\\u00f1o 0 reservado 0 Informaci\\u00f3n BTRFS (dispositivo sda): chunk_block_rsv: tama\\u00f1o 0 reservado 0 Informaci\\u00f3n BTRFS (dispositivo sda): delayed_block_rsv: tama\\u00f1o 0 reservado 0 Informaci\\u00f3n BTRFS (dispositivo sda): delayed_refs_rsv: tama\\u00f1o 0 reservado 0 Arriba $dev es un HDD zonificado emulado tcmu-runner, que tiene un tama\\u00f1o m\\u00e1ximo de anexi\\u00f3n de zona de 64K, y el sistema tiene un tama\\u00f1o de p\\u00e1gina de 64K. [CAUSA] He a\\u00f1adido varios trace_printk() para mostrar los eventos (encabezado omitido): \u0026gt; btrfs_dirty_pages: r/i=5/259 dirty start=774144 len=114688 \u0026gt; btrfs_dirty_pages: r/i=5/259 dirty part of page=720896 off_in_page=53248 len_in_page=12288 \u0026gt; btrfs_dirty_pages: r/i=5/259 dirty part of page=786432 off_in_page=0 len_in_page=65536 \u0026gt; btrfs_dirty_pages: r/i=5/259 dirty part of page=851968 off_in_page=0 len_in_page=36864 Las l\\u00edneas anteriores muestran que nuestra escritura en b\\u00fafer ha ensuciado 3 p\\u00e1ginas de inodo 259 de la ra\\u00edz 5: 704K 768K 832K 896K --- truncado ----\"}]",
      "id": "CVE-2024-44972",
      "lastModified": "2024-10-03T16:10:12.077",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-09-04T19:15:31.430",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/97713b1a2ced1e4a2a6c40045903797ebd44d7e0\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/ba4dedb71356638d8284e34724daca944be70368\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/d3b403209f767e5857c1b9fda66726e6e6ffc99f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-44972\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-04T19:15:31.430\",\"lastModified\":\"2026-01-05T11:16:58.847\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.\"}],\"metrics\":{},\"references\":[]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-01-13T23:16:56+00:00",
      "cve": "CVE-2024-44972",
      "id": "CVE-2024-44972",
      "initial_release_date": "2024-09-04T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: btrfs: do not clear page dirty inside extent_write_locked_range()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-44972.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T16:59:05Z",
      "cve": "CVE-2024-44972",
      "id": "CVE-2024-44972",
      "initial_release_date": "2024-09-05T02:46:56Z",
      "product_status:known_affected": "340",
      "product_status:known_not_affected": "477",
      "product_status:recommended": "273",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-44972",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-44972.json",
      "version": "37"
    },
    "vulnrichment": {
      "containers": "{\"cna\": {\"rejectedReasons\": [{\"lang\": \"en\", \"value\": \"This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-01-05T11:10:47.949Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-44972\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"state\": \"REJECTED\", \"assignerShortName\": \"Linux\", \"dateReserved\": \"2024-08-21T05:34:56.669Z\", \"datePublished\": \"2024-09-04T18:56:48.145Z\", \"dateUpdated\": \"2026-01-05T11:10:47.949Z\", \"dateRejected\": \"2026-01-05T11:10:47.949Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.