GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2024-48875 (GCVE-0-2024-48875)

Vulnerability from cvelistv5 – Published: 2025-01-11 12:25 – Updated: 2026-05-11 20:40
VLAI
Title
btrfs: don't take dev_replace rwsem on task already holding it
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: don't take dev_replace rwsem on task already holding it Running fstests btrfs/011 with MKFS_OPTIONS="-O rst" to force the usage of the RAID stripe-tree, we get the following splat from lockdep: BTRFS info (device sdd): dev_replace from /dev/sdd (devid 1) to /dev/sdb started ============================================ WARNING: possible recursive locking detected 6.11.0-rc3-btrfs-for-next #599 Not tainted -------------------------------------------- btrfs/2326 is trying to acquire lock: ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250 but task is already holding lock: ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&fs_info->dev_replace.rwsem); lock(&fs_info->dev_replace.rwsem); *** DEADLOCK *** May be due to missing lock nesting notation 1 lock held by btrfs/2326: #0: ffff88810f215c98 (&fs_info->dev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250 stack backtrace: CPU: 1 UID: 0 PID: 2326 Comm: btrfs Not tainted 6.11.0-rc3-btrfs-for-next #599 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: <TASK> dump_stack_lvl+0x5b/0x80 __lock_acquire+0x2798/0x69d0 ? __pfx___lock_acquire+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 lock_acquire+0x19d/0x4a0 ? btrfs_map_block+0x39f/0x2250 ? __pfx_lock_acquire+0x10/0x10 ? find_held_lock+0x2d/0x110 ? lock_is_held_type+0x8f/0x100 down_read+0x8e/0x440 ? btrfs_map_block+0x39f/0x2250 ? __pfx_down_read+0x10/0x10 ? do_raw_read_unlock+0x44/0x70 ? _raw_read_unlock+0x23/0x40 btrfs_map_block+0x39f/0x2250 ? btrfs_dev_replace_by_ioctl+0xd69/0x1d00 ? btrfs_bio_counter_inc_blocked+0xd9/0x2e0 ? __kasan_slab_alloc+0x6e/0x70 ? __pfx_btrfs_map_block+0x10/0x10 ? __pfx_btrfs_bio_counter_inc_blocked+0x10/0x10 ? kmem_cache_alloc_noprof+0x1f2/0x300 ? mempool_alloc_noprof+0xed/0x2b0 btrfs_submit_chunk+0x28d/0x17e0 ? __pfx_btrfs_submit_chunk+0x10/0x10 ? bvec_alloc+0xd7/0x1b0 ? bio_add_folio+0x171/0x270 ? __pfx_bio_add_folio+0x10/0x10 ? __kasan_check_read+0x20/0x20 btrfs_submit_bio+0x37/0x80 read_extent_buffer_pages+0x3df/0x6c0 btrfs_read_extent_buffer+0x13e/0x5f0 read_tree_block+0x81/0xe0 read_block_for_search+0x4bd/0x7a0 ? __pfx_read_block_for_search+0x10/0x10 btrfs_search_slot+0x78d/0x2720 ? __pfx_btrfs_search_slot+0x10/0x10 ? lock_is_held_type+0x8f/0x100 ? kasan_save_track+0x14/0x30 ? __kasan_slab_alloc+0x6e/0x70 ? kmem_cache_alloc_noprof+0x1f2/0x300 btrfs_get_raid_extent_offset+0x181/0x820 ? __pfx_lock_acquire+0x10/0x10 ? __pfx_btrfs_get_raid_extent_offset+0x10/0x10 ? down_read+0x194/0x440 ? __pfx_down_read+0x10/0x10 ? do_raw_read_unlock+0x44/0x70 ? _raw_read_unlock+0x23/0x40 btrfs_map_block+0x5b5/0x2250 ? __pfx_btrfs_map_block+0x10/0x10 scrub_submit_initial_read+0x8fe/0x11b0 ? __pfx_scrub_submit_initial_read+0x10/0x10 submit_initial_group_read+0x161/0x3a0 ? lock_release+0x20e/0x710 ? __pfx_submit_initial_group_read+0x10/0x10 ? __pfx_lock_release+0x10/0x10 scrub_simple_mirror.isra.0+0x3eb/0x580 scrub_stripe+0xe4d/0x1440 ? lock_release+0x20e/0x710 ? __pfx_scrub_stripe+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? do_raw_read_unlock+0x44/0x70 ? _raw_read_unlock+0x23/0x40 scrub_chunk+0x257/0x4a0 scrub_enumerate_chunks+0x64c/0xf70 ? __mutex_unlock_slowpath+0x147/0x5f0 ? __pfx_scrub_enumerate_chunks+0x10/0x10 ? bit_wait_timeout+0xb0/0x170 ? __up_read+0x189/0x700 ? scrub_workers_get+0x231/0x300 ? up_write+0x490/0x4f0 btrfs_scrub_dev+0x52e/0xcd0 ? create_pending_snapshots+0x230/0x250 ? __pfx_btrfs_scrub_dev+0x10/0x10 btrfs_dev_replace_by_ioctl+0xd69/0x1d00 ? lock_acquire+0x19d/0x4a0 ? __pfx_btrfs_dev_replace_by_ioctl+0x10/0x10 ? ---truncated---
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:55 UTC
CWE
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 10e27980f2ff66ba0c6da55f33b4814d5bc86573 , < a2e99dcd7aafa9d474f7d9b0740b8f93c4e156c2 (git)
Affected: 10e27980f2ff66ba0c6da55f33b4814d5bc86573 , < 8cca35cb29f81eba3e96ec44dad8696c8a2f9138 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.12.5 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-48875",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:55:40.762435Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-667",
                "description": "CWE-667 Improper Locking",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:57:22.119Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/dev-replace.c",
            "fs/btrfs/fs.h",
            "fs/btrfs/volumes.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a2e99dcd7aafa9d474f7d9b0740b8f93c4e156c2",
              "status": "affected",
              "version": "10e27980f2ff66ba0c6da55f33b4814d5bc86573",
              "versionType": "git"
            },
            {
              "lessThan": "8cca35cb29f81eba3e96ec44dad8696c8a2f9138",
              "status": "affected",
              "version": "10e27980f2ff66ba0c6da55f33b4814d5bc86573",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/dev-replace.c",
            "fs/btrfs/fs.h",
            "fs/btrfs/volumes.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don\u0027t take dev_replace rwsem on task already holding it\n\nRunning fstests btrfs/011 with MKFS_OPTIONS=\"-O rst\" to force the usage of\nthe RAID stripe-tree, we get the following splat from lockdep:\n\n BTRFS info (device sdd): dev_replace from /dev/sdd (devid 1) to /dev/sdb started\n\n ============================================\n WARNING: possible recursive locking detected\n 6.11.0-rc3-btrfs-for-next #599 Not tainted\n --------------------------------------------\n btrfs/2326 is trying to acquire lock:\n ffff88810f215c98 (\u0026fs_info-\u003edev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250\n\n but task is already holding lock:\n ffff88810f215c98 (\u0026fs_info-\u003edev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250\n\n other info that might help us debug this:\n  Possible unsafe locking scenario:\n\n        CPU0\n        ----\n   lock(\u0026fs_info-\u003edev_replace.rwsem);\n   lock(\u0026fs_info-\u003edev_replace.rwsem);\n\n  *** DEADLOCK ***\n\n  May be due to missing lock nesting notation\n\n 1 lock held by btrfs/2326:\n  #0: ffff88810f215c98 (\u0026fs_info-\u003edev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250\n\n stack backtrace:\n CPU: 1 UID: 0 PID: 2326 Comm: btrfs Not tainted 6.11.0-rc3-btrfs-for-next #599\n Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\n Call Trace:\n  \u003cTASK\u003e\n  dump_stack_lvl+0x5b/0x80\n  __lock_acquire+0x2798/0x69d0\n  ? __pfx___lock_acquire+0x10/0x10\n  ? __pfx___lock_acquire+0x10/0x10\n  lock_acquire+0x19d/0x4a0\n  ? btrfs_map_block+0x39f/0x2250\n  ? __pfx_lock_acquire+0x10/0x10\n  ? find_held_lock+0x2d/0x110\n  ? lock_is_held_type+0x8f/0x100\n  down_read+0x8e/0x440\n  ? btrfs_map_block+0x39f/0x2250\n  ? __pfx_down_read+0x10/0x10\n  ? do_raw_read_unlock+0x44/0x70\n  ? _raw_read_unlock+0x23/0x40\n  btrfs_map_block+0x39f/0x2250\n  ? btrfs_dev_replace_by_ioctl+0xd69/0x1d00\n  ? btrfs_bio_counter_inc_blocked+0xd9/0x2e0\n  ? __kasan_slab_alloc+0x6e/0x70\n  ? __pfx_btrfs_map_block+0x10/0x10\n  ? __pfx_btrfs_bio_counter_inc_blocked+0x10/0x10\n  ? kmem_cache_alloc_noprof+0x1f2/0x300\n  ? mempool_alloc_noprof+0xed/0x2b0\n  btrfs_submit_chunk+0x28d/0x17e0\n  ? __pfx_btrfs_submit_chunk+0x10/0x10\n  ? bvec_alloc+0xd7/0x1b0\n  ? bio_add_folio+0x171/0x270\n  ? __pfx_bio_add_folio+0x10/0x10\n  ? __kasan_check_read+0x20/0x20\n  btrfs_submit_bio+0x37/0x80\n  read_extent_buffer_pages+0x3df/0x6c0\n  btrfs_read_extent_buffer+0x13e/0x5f0\n  read_tree_block+0x81/0xe0\n  read_block_for_search+0x4bd/0x7a0\n  ? __pfx_read_block_for_search+0x10/0x10\n  btrfs_search_slot+0x78d/0x2720\n  ? __pfx_btrfs_search_slot+0x10/0x10\n  ? lock_is_held_type+0x8f/0x100\n  ? kasan_save_track+0x14/0x30\n  ? __kasan_slab_alloc+0x6e/0x70\n  ? kmem_cache_alloc_noprof+0x1f2/0x300\n  btrfs_get_raid_extent_offset+0x181/0x820\n  ? __pfx_lock_acquire+0x10/0x10\n  ? __pfx_btrfs_get_raid_extent_offset+0x10/0x10\n  ? down_read+0x194/0x440\n  ? __pfx_down_read+0x10/0x10\n  ? do_raw_read_unlock+0x44/0x70\n  ? _raw_read_unlock+0x23/0x40\n  btrfs_map_block+0x5b5/0x2250\n  ? __pfx_btrfs_map_block+0x10/0x10\n  scrub_submit_initial_read+0x8fe/0x11b0\n  ? __pfx_scrub_submit_initial_read+0x10/0x10\n  submit_initial_group_read+0x161/0x3a0\n  ? lock_release+0x20e/0x710\n  ? __pfx_submit_initial_group_read+0x10/0x10\n  ? __pfx_lock_release+0x10/0x10\n  scrub_simple_mirror.isra.0+0x3eb/0x580\n  scrub_stripe+0xe4d/0x1440\n  ? lock_release+0x20e/0x710\n  ? __pfx_scrub_stripe+0x10/0x10\n  ? __pfx_lock_release+0x10/0x10\n  ? do_raw_read_unlock+0x44/0x70\n  ? _raw_read_unlock+0x23/0x40\n  scrub_chunk+0x257/0x4a0\n  scrub_enumerate_chunks+0x64c/0xf70\n  ? __mutex_unlock_slowpath+0x147/0x5f0\n  ? __pfx_scrub_enumerate_chunks+0x10/0x10\n  ? bit_wait_timeout+0xb0/0x170\n  ? __up_read+0x189/0x700\n  ? scrub_workers_get+0x231/0x300\n  ? up_write+0x490/0x4f0\n  btrfs_scrub_dev+0x52e/0xcd0\n  ? create_pending_snapshots+0x230/0x250\n  ? __pfx_btrfs_scrub_dev+0x10/0x10\n  btrfs_dev_replace_by_ioctl+0xd69/0x1d00\n  ? lock_acquire+0x19d/0x4a0\n  ? __pfx_btrfs_dev_replace_by_ioctl+0x10/0x10\n  ?\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:40:16.557Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a2e99dcd7aafa9d474f7d9b0740b8f93c4e156c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/8cca35cb29f81eba3e96ec44dad8696c8a2f9138"
        }
      ],
      "title": "btrfs: don\u0027t take dev_replace rwsem on task already holding it",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-48875",
    "datePublished": "2025-01-11T12:25:16.981Z",
    "dateReserved": "2025-01-09T09:51:32.472Z",
    "dateUpdated": "2026-05-11T20:40:16.557Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-48875",
      "date": "2026-09-17",
      "epss": "0.00146",
      "percentile": "0.04229"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: don\u0027t take dev_replace rwsem on task already holding it\\n\\nRunning fstests btrfs/011 with MKFS_OPTIONS=\\\"-O rst\\\" to force the usage of\\nthe RAID stripe-tree, we get the following splat from lockdep:\\n\\n BTRFS info (device sdd): dev_replace from /dev/sdd (devid 1) to /dev/sdb started\\n\\n ============================================\\n WARNING: possible recursive locking detected\\n 6.11.0-rc3-btrfs-for-next #599 Not tainted\\n --------------------------------------------\\n btrfs/2326 is trying to acquire lock:\\n ffff88810f215c98 (\u0026fs_info-\u003edev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250\\n\\n but task is already holding lock:\\n ffff88810f215c98 (\u0026fs_info-\u003edev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250\\n\\n other info that might help us debug this:\\n  Possible unsafe locking scenario:\\n\\n        CPU0\\n        ----\\n   lock(\u0026fs_info-\u003edev_replace.rwsem);\\n   lock(\u0026fs_info-\u003edev_replace.rwsem);\\n\\n  *** DEADLOCK ***\\n\\n  May be due to missing lock nesting notation\\n\\n 1 lock held by btrfs/2326:\\n  #0: ffff88810f215c98 (\u0026fs_info-\u003edev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250\\n\\n stack backtrace:\\n CPU: 1 UID: 0 PID: 2326 Comm: btrfs Not tainted 6.11.0-rc3-btrfs-for-next #599\\n Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\\n Call Trace:\\n  \u003cTASK\u003e\\n  dump_stack_lvl+0x5b/0x80\\n  __lock_acquire+0x2798/0x69d0\\n  ? __pfx___lock_acquire+0x10/0x10\\n  ? __pfx___lock_acquire+0x10/0x10\\n  lock_acquire+0x19d/0x4a0\\n  ? btrfs_map_block+0x39f/0x2250\\n  ? __pfx_lock_acquire+0x10/0x10\\n  ? find_held_lock+0x2d/0x110\\n  ? lock_is_held_type+0x8f/0x100\\n  down_read+0x8e/0x440\\n  ? btrfs_map_block+0x39f/0x2250\\n  ? __pfx_down_read+0x10/0x10\\n  ? do_raw_read_unlock+0x44/0x70\\n  ? _raw_read_unlock+0x23/0x40\\n  btrfs_map_block+0x39f/0x2250\\n  ? btrfs_dev_replace_by_ioctl+0xd69/0x1d00\\n  ? btrfs_bio_counter_inc_blocked+0xd9/0x2e0\\n  ? __kasan_slab_alloc+0x6e/0x70\\n  ? __pfx_btrfs_map_block+0x10/0x10\\n  ? __pfx_btrfs_bio_counter_inc_blocked+0x10/0x10\\n  ? kmem_cache_alloc_noprof+0x1f2/0x300\\n  ? mempool_alloc_noprof+0xed/0x2b0\\n  btrfs_submit_chunk+0x28d/0x17e0\\n  ? __pfx_btrfs_submit_chunk+0x10/0x10\\n  ? bvec_alloc+0xd7/0x1b0\\n  ? bio_add_folio+0x171/0x270\\n  ? __pfx_bio_add_folio+0x10/0x10\\n  ? __kasan_check_read+0x20/0x20\\n  btrfs_submit_bio+0x37/0x80\\n  read_extent_buffer_pages+0x3df/0x6c0\\n  btrfs_read_extent_buffer+0x13e/0x5f0\\n  read_tree_block+0x81/0xe0\\n  read_block_for_search+0x4bd/0x7a0\\n  ? __pfx_read_block_for_search+0x10/0x10\\n  btrfs_search_slot+0x78d/0x2720\\n  ? __pfx_btrfs_search_slot+0x10/0x10\\n  ? lock_is_held_type+0x8f/0x100\\n  ? kasan_save_track+0x14/0x30\\n  ? __kasan_slab_alloc+0x6e/0x70\\n  ? kmem_cache_alloc_noprof+0x1f2/0x300\\n  btrfs_get_raid_extent_offset+0x181/0x820\\n  ? __pfx_lock_acquire+0x10/0x10\\n  ? __pfx_btrfs_get_raid_extent_offset+0x10/0x10\\n  ? down_read+0x194/0x440\\n  ? __pfx_down_read+0x10/0x10\\n  ? do_raw_read_unlock+0x44/0x70\\n  ? _raw_read_unlock+0x23/0x40\\n  btrfs_map_block+0x5b5/0x2250\\n  ? __pfx_btrfs_map_block+0x10/0x10\\n  scrub_submit_initial_read+0x8fe/0x11b0\\n  ? __pfx_scrub_submit_initial_read+0x10/0x10\\n  submit_initial_group_read+0x161/0x3a0\\n  ? lock_release+0x20e/0x710\\n  ? __pfx_submit_initial_group_read+0x10/0x10\\n  ? __pfx_lock_release+0x10/0x10\\n  scrub_simple_mirror.isra.0+0x3eb/0x580\\n  scrub_stripe+0xe4d/0x1440\\n  ? lock_release+0x20e/0x710\\n  ? __pfx_scrub_stripe+0x10/0x10\\n  ? __pfx_lock_release+0x10/0x10\\n  ? do_raw_read_unlock+0x44/0x70\\n  ? _raw_read_unlock+0x23/0x40\\n  scrub_chunk+0x257/0x4a0\\n  scrub_enumerate_chunks+0x64c/0xf70\\n  ? __mutex_unlock_slowpath+0x147/0x5f0\\n  ? __pfx_scrub_enumerate_chunks+0x10/0x10\\n  ? bit_wait_timeout+0xb0/0x170\\n  ? __up_read+0x189/0x700\\n  ? scrub_workers_get+0x231/0x300\\n  ? up_write+0x490/0x4f0\\n  btrfs_scrub_dev+0x52e/0xcd0\\n  ? create_pending_snapshots+0x230/0x250\\n  ? __pfx_btrfs_scrub_dev+0x10/0x10\\n  btrfs_dev_replace_by_ioctl+0xd69/0x1d00\\n  ? lock_acquire+0x19d/0x4a0\\n  ? __pfx_btrfs_dev_replace_by_ioctl+0x10/0x10\\n  ?\\n---truncated---\"}]",
      "id": "CVE-2024-48875",
      "lastModified": "2025-01-11T13:15:22.933",
      "published": "2025-01-11T13:15:22.933",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/8cca35cb29f81eba3e96ec44dad8696c8a2f9138\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a2e99dcd7aafa9d474f7d9b0740b8f93c4e156c2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/a5bc4e030f50fdbb1fbc69acc1e0c5f57c79d044\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Received"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-07T04:14:33.000Z",
      "cve": "CVE-2024-48875",
      "id": "msrc_CVE-2024-48875",
      "initial_release_date": "2025-03-13T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "product_status:under_investigation": "4",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "btrfs: don\u0027t take dev_replace rwsem on task already holding it",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-48875.json",
      "version": "5"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-48875\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-11T13:15:22.933\",\"lastModified\":\"2026-06-17T07:58:56.987\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: don\u0027t take dev_replace rwsem on task already holding it\\n\\nRunning fstests btrfs/011 with MKFS_OPTIONS=\\\"-O rst\\\" to force the usage of\\nthe RAID stripe-tree, we get the following splat from lockdep:\\n\\n BTRFS info (device sdd): dev_replace from /dev/sdd (devid 1) to /dev/sdb started\\n\\n ============================================\\n WARNING: possible recursive locking detected\\n 6.11.0-rc3-btrfs-for-next #599 Not tainted\\n --------------------------------------------\\n btrfs/2326 is trying to acquire lock:\\n ffff88810f215c98 (\u0026fs_info-\u003edev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250\\n\\n but task is already holding lock:\\n ffff88810f215c98 (\u0026fs_info-\u003edev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250\\n\\n other info that might help us debug this:\\n  Possible unsafe locking scenario:\\n\\n        CPU0\\n        ----\\n   lock(\u0026fs_info-\u003edev_replace.rwsem);\\n   lock(\u0026fs_info-\u003edev_replace.rwsem);\\n\\n  *** DEADLOCK ***\\n\\n  May be due to missing lock nesting notation\\n\\n 1 lock held by btrfs/2326:\\n  #0: ffff88810f215c98 (\u0026fs_info-\u003edev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250\\n\\n stack backtrace:\\n CPU: 1 UID: 0 PID: 2326 Comm: btrfs Not tainted 6.11.0-rc3-btrfs-for-next #599\\n Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\\n Call Trace:\\n  \u003cTASK\u003e\\n  dump_stack_lvl+0x5b/0x80\\n  __lock_acquire+0x2798/0x69d0\\n  ? __pfx___lock_acquire+0x10/0x10\\n  ? __pfx___lock_acquire+0x10/0x10\\n  lock_acquire+0x19d/0x4a0\\n  ? btrfs_map_block+0x39f/0x2250\\n  ? __pfx_lock_acquire+0x10/0x10\\n  ? find_held_lock+0x2d/0x110\\n  ? lock_is_held_type+0x8f/0x100\\n  down_read+0x8e/0x440\\n  ? btrfs_map_block+0x39f/0x2250\\n  ? __pfx_down_read+0x10/0x10\\n  ? do_raw_read_unlock+0x44/0x70\\n  ? _raw_read_unlock+0x23/0x40\\n  btrfs_map_block+0x39f/0x2250\\n  ? btrfs_dev_replace_by_ioctl+0xd69/0x1d00\\n  ? btrfs_bio_counter_inc_blocked+0xd9/0x2e0\\n  ? __kasan_slab_alloc+0x6e/0x70\\n  ? __pfx_btrfs_map_block+0x10/0x10\\n  ? __pfx_btrfs_bio_counter_inc_blocked+0x10/0x10\\n  ? kmem_cache_alloc_noprof+0x1f2/0x300\\n  ? mempool_alloc_noprof+0xed/0x2b0\\n  btrfs_submit_chunk+0x28d/0x17e0\\n  ? __pfx_btrfs_submit_chunk+0x10/0x10\\n  ? bvec_alloc+0xd7/0x1b0\\n  ? bio_add_folio+0x171/0x270\\n  ? __pfx_bio_add_folio+0x10/0x10\\n  ? __kasan_check_read+0x20/0x20\\n  btrfs_submit_bio+0x37/0x80\\n  read_extent_buffer_pages+0x3df/0x6c0\\n  btrfs_read_extent_buffer+0x13e/0x5f0\\n  read_tree_block+0x81/0xe0\\n  read_block_for_search+0x4bd/0x7a0\\n  ? __pfx_read_block_for_search+0x10/0x10\\n  btrfs_search_slot+0x78d/0x2720\\n  ? __pfx_btrfs_search_slot+0x10/0x10\\n  ? lock_is_held_type+0x8f/0x100\\n  ? kasan_save_track+0x14/0x30\\n  ? __kasan_slab_alloc+0x6e/0x70\\n  ? kmem_cache_alloc_noprof+0x1f2/0x300\\n  btrfs_get_raid_extent_offset+0x181/0x820\\n  ? __pfx_lock_acquire+0x10/0x10\\n  ? __pfx_btrfs_get_raid_extent_offset+0x10/0x10\\n  ? down_read+0x194/0x440\\n  ? __pfx_down_read+0x10/0x10\\n  ? do_raw_read_unlock+0x44/0x70\\n  ? _raw_read_unlock+0x23/0x40\\n  btrfs_map_block+0x5b5/0x2250\\n  ? __pfx_btrfs_map_block+0x10/0x10\\n  scrub_submit_initial_read+0x8fe/0x11b0\\n  ? __pfx_scrub_submit_initial_read+0x10/0x10\\n  submit_initial_group_read+0x161/0x3a0\\n  ? lock_release+0x20e/0x710\\n  ? __pfx_submit_initial_group_read+0x10/0x10\\n  ? __pfx_lock_release+0x10/0x10\\n  scrub_simple_mirror.isra.0+0x3eb/0x580\\n  scrub_stripe+0xe4d/0x1440\\n  ? lock_release+0x20e/0x710\\n  ? __pfx_scrub_stripe+0x10/0x10\\n  ? __pfx_lock_release+0x10/0x10\\n  ? do_raw_read_unlock+0x44/0x70\\n  ? _raw_read_unlock+0x23/0x40\\n  scrub_chunk+0x257/0x4a0\\n  scrub_enumerate_chunks+0x64c/0xf70\\n  ? __mutex_unlock_slowpath+0x147/0x5f0\\n  ? __pfx_scrub_enumerate_chunks+0x10/0x10\\n  ? bit_wait_timeout+0xb0/0x170\\n  ? __up_read+0x189/0x700\\n  ? scrub_workers_get+0x231/0x300\\n  ? up_write+0x490/0x4f0\\n  btrfs_scrub_dev+0x52e/0xcd0\\n  ? create_pending_snapshots+0x230/0x250\\n  ? __pfx_btrfs_scrub_dev+0x10/0x10\\n  btrfs_dev_replace_by_ioctl+0xd69/0x1d00\\n  ? lock_acquire+0x19d/0x4a0\\n  ? __pfx_btrfs_dev_replace_by_ioctl+0x10/0x10\\n  ?\\n---truncated---\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: no tome dev_replace rwsem en la tarea que ya lo contiene Al ejecutar fstests btrfs/011 con MKFS_OPTIONS=\\\"-O rst\\\" para forzar el uso del \u00e1rbol de bandas RAID, obtenemos el siguiente mensaje de lockdep: Informaci\u00f3n de BTRFS (dispositivo sdd): dev_replace de /dev/sdd (devid 1) a /dev/sdb iniciado ============================================ ADVERTENCIA: se detect\u00f3 un posible bloqueo recursivo 6.11.0-rc3-btrfs-for-next #599 No contaminado -------------------------------------------- btrfs/2326 est\u00e1 intentando adquirir el bloqueo: ffff88810f215c98 (\u0026amp;fs_info-\u0026gt;dev_replace.rwsem){++++}-{3:3}, en: btrfs_map_block+0x39f/0x2250 pero la tarea ya tiene el bloqueo: ffff88810f215c98 (\u0026amp;fs_info-\u0026gt;dev_replace.rwsem){++++}-{3:3}, en: btrfs_map_block+0x39f/0x2250 otra informaci\u00f3n que podr\u00eda ayudarnos a depurar esto: Posible escenario de bloqueo inseguro: CPU0 ---- lock(\u0026amp;fs_info-\u0026gt;dev_replace.rwsem); lock(\u0026amp;fs_info-\u0026gt;dev_replace.rwsem); *** BLOQUEO INTERMEDIO *** Puede deberse a la falta de notaci\u00f3n de anidamiento de bloqueo 1 bloqueo mantenido por btrfs/2326: #0: ffff88810f215c98 (\u0026amp;fs_info-\u0026gt;dev_replace.rwsem){++++}-{3:3}, en: btrfs_map_block+0x39f/0x2250 seguimiento de pila: CPU: 1 UID: 0 PID: 2326 Comm: btrfs No contaminado 6.11.0-rc3-btrfs-for-next #599 Nombre del hardware: Bochs Bochs, BIOS Bochs 01/01/2011 Seguimiento de llamadas:  dump_stack_lvl+0x5b/0x80 __lock_acquire+0x2798/0x69d0 ? __pfx___lock_acquire+0x10/0x10 ? __pfx___lock_acquire+0x10/0x10 lock_acquire+0x19d/0x4a0 ? btrfs_map_block+0x39f/0x2250 ? __pfx_lock_acquire+0x10/0x10 ? find_held_lock+0x2d/0x110 ? lock_is_held_type+0x8f/0x100 down_read+0x8e/0x440 ? btrfs_map_block+0x39f/0x2250 ? __pfx_down_read+0x10/0x10 ? do_raw_read_unlock+0x44/0x70 ? kmem_cache_alloc_noprof+0x1f2/0x300 ? bvec_alloc+0xd7/0x1b0 ? bio_add_folio+0x171/0x270 ? __pfx_bio_add_folio+0x10/0x10 ? __kasan_check_read+0x20/0x20 btrfs_submit_bio+0x37/0x80 lectura_extensi\u00f3n_b\u00fafer_p\u00e1ginas+0x3df/0x6c0 btrfs_lectura_extensi\u00f3n_b\u00fafer+0x13e/0x5f0 lectura_\u00e1rbol_bloque+0x81/0xe0 lectura_bloque_para_b\u00fasqueda+0x4bd/0x7a0 ? __pfx_lectura_bloque_para_b\u00fasqueda+0x10/0x10 btrfs_b\u00fasqueda_slot+0x78d/0x2720 ? __pfx_btrfs_b\u00fasqueda_slot+0x10/0x10 ? bloqueo_se_retiene_tipo+0x8f/0x100 ? kasan_guardar_pista+0x14/0x30 ? __kasan_slab_alloc+0x6e/0x70 ? kmem_cache_alloc_noprof+0x1f2/0x300 btrfs_get_raid_extent_offset+0x181/0x820 ? __pfx_lock_acquire+0x10/0x10 ? __pfx_btrfs_get_raid_extent_offset+0x10/0x10 ? down_read+0x194/0x440 ? __pfx_down_read+0x10/0x10 ? do_raw_read_unlock+0x44/0x70 ? _raw_read_unlock+0x23/0x40 btrfs_map_block+0x5b5/0x2250 ? liberaci\u00f3n de bloqueo+0x20e/0x710 ? __pfx_scrub_stripe+0x10/0x10 ? __pfx_lock_release+0x10/0x10 ? hacer_desbloqueo_lectura_sin_encriptar+0x44/0x70 ? _desbloqueo_lectura_sin_encriptar+0x23/0x40 fragmento_de_scruzamiento+0x257/0x4a0 fragmento_de_scruzamiento_enumerar+0x64c/0xf70 ? __mutex_unlock_slowpath+0x147/0x5f0 ? __pfx_scrub_enumerar_chunks+0x10/0x10 ? tiempo_de_espera_bit+0xb0/0x170 ? __up_read+0x189/0x700 ? obtenci\u00f3n_trabajadores_de_scruzamiento+0x231/0x300 ? up_write+0x490/0x4f0 btrfs_scrub_dev+0x52e/0xcd0 ? create_pending_snapshots+0x230/0x250 ? __pfx_btrfs_scrub_dev+0x10/0x10 btrfs_dev_replace_by_ioctl+0xd69/0x1d00 ? lock_acquire+0x19d/0x4a0 ? __pfx_btrfs_dev_replace_by_ioctl+0x10/0x10 ? ---truncado---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/btrfs/dev-replace.c\",\"fs/btrfs/fs.h\",\"fs/btrfs/volumes.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"10e27980f2ff66ba0c6da55f33b4814d5bc86573\",\"lessThan\":\"a2e99dcd7aafa9d474f7d9b0740b8f93c4e156c2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"10e27980f2ff66ba0c6da55f33b4814d5bc86573\",\"lessThan\":\"8cca35cb29f81eba3e96ec44dad8696c8a2f9138\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/btrfs/dev-replace.c\",\"fs/btrfs/fs.h\",\"fs/btrfs/volumes.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.5\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:55:40.762435Z\",\"id\":\"CVE-2024-48875\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-667\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.6.66\",\"matchCriteriaId\":\"90A079EF-8212-45DF-84FB-C525A64635B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.5\",\"matchCriteriaId\":\"9501D045-7A94-42CA-8B03-821BE94A65B7\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/8cca35cb29f81eba3e96ec44dad8696c8a2f9138\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a2e99dcd7aafa9d474f7d9b0740b8f93c4e156c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T13:51:14+00:00",
      "cve": "CVE-2024-48875",
      "id": "CVE-2024-48875",
      "initial_release_date": "2024-01-01T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "156",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: btrfs: don\u0027t take dev_replace rwsem on task already holding it",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-48875.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-30T02:21:46Z",
      "cve": "CVE-2024-48875",
      "id": "CVE-2024-48875",
      "initial_release_date": "2025-01-12T00:18:00Z",
      "product_status:known_not_affected": "567",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-48875",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-48875.json",
      "version": "27"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-48875\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:55:40.762435Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-667\", \"description\": \"CWE-667 Improper Locking\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:52:44.261Z\"}}], \"cna\": {\"title\": \"btrfs: don\u0027t take dev_replace rwsem on task already holding it\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"10e27980f2ff66ba0c6da55f33b4814d5bc86573\", \"lessThan\": \"a2e99dcd7aafa9d474f7d9b0740b8f93c4e156c2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"10e27980f2ff66ba0c6da55f33b4814d5bc86573\", \"lessThan\": \"8cca35cb29f81eba3e96ec44dad8696c8a2f9138\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/btrfs/dev-replace.c\", \"fs/btrfs/fs.h\", \"fs/btrfs/volumes.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.12.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/btrfs/dev-replace.c\", \"fs/btrfs/fs.h\", \"fs/btrfs/volumes.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/a2e99dcd7aafa9d474f7d9b0740b8f93c4e156c2\"}, {\"url\": \"https://git.kernel.org/stable/c/8cca35cb29f81eba3e96ec44dad8696c8a2f9138\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: don\u0027t take dev_replace rwsem on task already holding it\\n\\nRunning fstests btrfs/011 with MKFS_OPTIONS=\\\"-O rst\\\" to force the usage of\\nthe RAID stripe-tree, we get the following splat from lockdep:\\n\\n BTRFS info (device sdd): dev_replace from /dev/sdd (devid 1) to /dev/sdb started\\n\\n ============================================\\n WARNING: possible recursive locking detected\\n 6.11.0-rc3-btrfs-for-next #599 Not tainted\\n --------------------------------------------\\n btrfs/2326 is trying to acquire lock:\\n ffff88810f215c98 (\u0026fs_info-\u003edev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250\\n\\n but task is already holding lock:\\n ffff88810f215c98 (\u0026fs_info-\u003edev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250\\n\\n other info that might help us debug this:\\n  Possible unsafe locking scenario:\\n\\n        CPU0\\n        ----\\n   lock(\u0026fs_info-\u003edev_replace.rwsem);\\n   lock(\u0026fs_info-\u003edev_replace.rwsem);\\n\\n  *** DEADLOCK ***\\n\\n  May be due to missing lock nesting notation\\n\\n 1 lock held by btrfs/2326:\\n  #0: ffff88810f215c98 (\u0026fs_info-\u003edev_replace.rwsem){++++}-{3:3}, at: btrfs_map_block+0x39f/0x2250\\n\\n stack backtrace:\\n CPU: 1 UID: 0 PID: 2326 Comm: btrfs Not tainted 6.11.0-rc3-btrfs-for-next #599\\n Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011\\n Call Trace:\\n  \u003cTASK\u003e\\n  dump_stack_lvl+0x5b/0x80\\n  __lock_acquire+0x2798/0x69d0\\n  ? __pfx___lock_acquire+0x10/0x10\\n  ? __pfx___lock_acquire+0x10/0x10\\n  lock_acquire+0x19d/0x4a0\\n  ? btrfs_map_block+0x39f/0x2250\\n  ? __pfx_lock_acquire+0x10/0x10\\n  ? find_held_lock+0x2d/0x110\\n  ? lock_is_held_type+0x8f/0x100\\n  down_read+0x8e/0x440\\n  ? btrfs_map_block+0x39f/0x2250\\n  ? __pfx_down_read+0x10/0x10\\n  ? do_raw_read_unlock+0x44/0x70\\n  ? _raw_read_unlock+0x23/0x40\\n  btrfs_map_block+0x39f/0x2250\\n  ? btrfs_dev_replace_by_ioctl+0xd69/0x1d00\\n  ? btrfs_bio_counter_inc_blocked+0xd9/0x2e0\\n  ? __kasan_slab_alloc+0x6e/0x70\\n  ? __pfx_btrfs_map_block+0x10/0x10\\n  ? __pfx_btrfs_bio_counter_inc_blocked+0x10/0x10\\n  ? kmem_cache_alloc_noprof+0x1f2/0x300\\n  ? mempool_alloc_noprof+0xed/0x2b0\\n  btrfs_submit_chunk+0x28d/0x17e0\\n  ? __pfx_btrfs_submit_chunk+0x10/0x10\\n  ? bvec_alloc+0xd7/0x1b0\\n  ? bio_add_folio+0x171/0x270\\n  ? __pfx_bio_add_folio+0x10/0x10\\n  ? __kasan_check_read+0x20/0x20\\n  btrfs_submit_bio+0x37/0x80\\n  read_extent_buffer_pages+0x3df/0x6c0\\n  btrfs_read_extent_buffer+0x13e/0x5f0\\n  read_tree_block+0x81/0xe0\\n  read_block_for_search+0x4bd/0x7a0\\n  ? __pfx_read_block_for_search+0x10/0x10\\n  btrfs_search_slot+0x78d/0x2720\\n  ? __pfx_btrfs_search_slot+0x10/0x10\\n  ? lock_is_held_type+0x8f/0x100\\n  ? kasan_save_track+0x14/0x30\\n  ? __kasan_slab_alloc+0x6e/0x70\\n  ? kmem_cache_alloc_noprof+0x1f2/0x300\\n  btrfs_get_raid_extent_offset+0x181/0x820\\n  ? __pfx_lock_acquire+0x10/0x10\\n  ? __pfx_btrfs_get_raid_extent_offset+0x10/0x10\\n  ? down_read+0x194/0x440\\n  ? __pfx_down_read+0x10/0x10\\n  ? do_raw_read_unlock+0x44/0x70\\n  ? _raw_read_unlock+0x23/0x40\\n  btrfs_map_block+0x5b5/0x2250\\n  ? __pfx_btrfs_map_block+0x10/0x10\\n  scrub_submit_initial_read+0x8fe/0x11b0\\n  ? __pfx_scrub_submit_initial_read+0x10/0x10\\n  submit_initial_group_read+0x161/0x3a0\\n  ? lock_release+0x20e/0x710\\n  ? __pfx_submit_initial_group_read+0x10/0x10\\n  ? __pfx_lock_release+0x10/0x10\\n  scrub_simple_mirror.isra.0+0x3eb/0x580\\n  scrub_stripe+0xe4d/0x1440\\n  ? lock_release+0x20e/0x710\\n  ? __pfx_scrub_stripe+0x10/0x10\\n  ? __pfx_lock_release+0x10/0x10\\n  ? do_raw_read_unlock+0x44/0x70\\n  ? _raw_read_unlock+0x23/0x40\\n  scrub_chunk+0x257/0x4a0\\n  scrub_enumerate_chunks+0x64c/0xf70\\n  ? __mutex_unlock_slowpath+0x147/0x5f0\\n  ? __pfx_scrub_enumerate_chunks+0x10/0x10\\n  ? bit_wait_timeout+0xb0/0x170\\n  ? __up_read+0x189/0x700\\n  ? scrub_workers_get+0x231/0x300\\n  ? up_write+0x490/0x4f0\\n  btrfs_scrub_dev+0x52e/0xcd0\\n  ? create_pending_snapshots+0x230/0x250\\n  ? __pfx_btrfs_scrub_dev+0x10/0x10\\n  btrfs_dev_replace_by_ioctl+0xd69/0x1d00\\n  ? lock_acquire+0x19d/0x4a0\\n  ? __pfx_btrfs_dev_replace_by_ioctl+0x10/0x10\\n  ?\\n---truncated---\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.5\", \"versionStartIncluding\": \"6.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"6.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T20:40:16.557Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-48875\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T20:40:16.557Z\", \"dateReserved\": \"2025-01-09T09:51:32.472Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-01-11T12:25:16.981Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.