[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-DEBIAN-CVE-2024-57975":6},{"stargazers_count":4,"fetched_at":5},7,"2026-06-04T14:53:31.930Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":11,"aliases":12,"duplicate_of":9,"upstream":13,"downstream":16,"duplicates":17,"related":18,"reserved_at":9,"published_at":19,"modified_at":20,"state":9,"summary":21,"references_raw":23,"kevs":30,"epss":9,"epss_history":31,"metrics":32,"affected":39},"DEBIAN-CVE-2024-57975","In the Linux kernel, the following vulnerability has been resolved:  btrfs: do proper folio cleanup when run_delalloc_nocow() failed  [BUG] With CONFIG_DEBUG_VM set, test case generic/476 has some chance to crash with the following VM_BUG_ON_FOLIO():    BTRFS error (device dm-3): cow_file_range failed, start 1146880 end 1253375 len 106496 ret -28   BTRFS error (device dm-3): run_delalloc_nocow failed, start 1146880 end 1253375 len 106496 ret -28   page: refcount:4 mapcount:0 mapping:00000000592787cc index:0x12 pfn:0x10664   aops:btrfs_aops [btrfs] ino:101 dentry name(?):\"f1774\"   flags: 0x2fffff80004028(uptodate|lru|private|node=0|zone=2|lastcpupid=0xfffff)   page dumped because: VM_BUG_ON_FOLIO(!folio_test_locked(folio))   ------------[ cut here ]------------   kernel BUG at mm/page-writeback.c:2992!   Internal error: Oops - BUG: 00000000f2000800 [#1] SMP   CPU: 2 UID: 0 PID: 3943513 Comm: kworker/u24:15 Tainted: G           OE      6.12.0-rc7-custom+ #87   Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE   Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022   Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs]   pc : folio_clear_dirty_for_io+0x128/0x258   lr : folio_clear_dirty_for_io+0x128/0x258   Call trace:    folio_clear_dirty_for_io+0x128/0x258    btrfs_folio_clamp_clear_dirty+0x80/0xd0 [btrfs]    __process_folios_contig+0x154/0x268 [btrfs]    extent_clear_unlock_delalloc+0x5c/0x80 [btrfs]    run_delalloc_nocow+0x5f8/0x760 [btrfs]    btrfs_run_delalloc_range+0xa8/0x220 [btrfs]    writepage_delalloc+0x230/0x4c8 [btrfs]    extent_writepage+0xb8/0x358 [btrfs]    extent_write_cache_pages+0x21c/0x4e8 [btrfs]    btrfs_writepages+0x94/0x150 [btrfs]    do_writepages+0x74/0x190    filemap_fdatawrite_wbc+0x88/0xc8    start_delalloc_inodes+0x178/0x3a8 [btrfs]    btrfs_start_delalloc_roots+0x174/0x280 [btrfs]    shrink_delalloc+0x114/0x280 [btrfs]    flush_space+0x250/0x2f8 [btrfs]    btrfs_async_reclaim_data_space+0x180/0x228 [btrfs]    process_one_work+0x164/0x408    worker_thread+0x25c/0x388    kthread+0x100/0x118    ret_from_fork+0x10/0x20   Code: 910a8021 a90363f7 a9046bf9 94012379 (d4210000)   ---[ end trace 0000000000000000 ]---  [CAUSE] The first two lines of extra debug messages show the problem is caused by the error handling of run_delalloc_nocow().  E.g. we have the following dirtied range (4K blocksize 4K page size):      0                 16K                  32K     |//////////////////////////////////////|     |  Pre-allocated  |  And the range [0, 16K) has a preallocated extent.  - Enter run_delalloc_nocow() for range [0, 16K)   Which found range [0, 16K) is preallocated, can do the proper NOCOW   write.  - Enter fallback_to_fow() for range [16K, 32K)   Since the range [16K, 32K) is not backed by preallocated extent, we   have to go COW.  - cow_file_range() failed for range [16K, 32K)   So cow_file_range() will do the clean up by clearing folio dirty,   unlock the folios.    Now the folios in range [16K, 32K) is unlocked.  - Enter extent_clear_unlock_delalloc() from run_delalloc_nocow()   Which is called with PAGE_START_WRITEBACK to start page writeback.   But folios can only be marked writeback when it's properly locked,   thus this triggered the VM_BUG_ON_FOLIO().  Furthermore there is another hidden but common bug that run_delalloc_nocow() is not clearing the folio dirty flags in its error handling path. This is the common bug shared between run_delalloc_nocow() and cow_file_range().  [FIX] - Clear folio dirty for range [@start, @cur_offset)   Introduce a helper, cleanup_dirty_folios(), which   will find and lock the folio in the range, clear the dirty flag and   start/end the writeback, with the extra handling for the   @locked_folio.  - Introduce a helper to clear folio dirty, start and end writeback  - Introduce a helper to record the last failed COW range end   This is to trace which range we should skip, to avoid double   unlocking.  - Skip the failed COW range for the e ---truncated---",null,[],[],[],[14],{"_key":15},"CVE-2024-57975",[],[],[],"2025-02-27T02:15:10.687Z","2026-04-28T20:30:13.000756Z",{"cisa_kev":22,"cisa_ransomware":22,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":9,"severity_score":9,"severity_version":9,"severity_source":9,"severity_vector":9,"severity_status":9},false,[24],{"url":25,"sources":26,"tags":28},"https://security-tracker.debian.org/tracker/CVE-2024-57975",[27],"osv_debian",[29],"Advisory",[],[],[33],{"source":27,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":34,"cvss_v4_0":9},{"baseScore":35,"baseSeverity":9,"vectorString":36,"impactScore":37,"exploitabilityScore":38},5.5,"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",6,4.6,[40],{"ecosystem":41,"name":42,"vendor":43,"product":42,"cpe_part":9,"purl_type":44,"purl_namespace":43,"purl_name":42,"source":9,"versions":45},"Debian","linux","debian","deb",[46,50,51,55],{"version":47,"is_range":48,"range_type":49,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},"all",true,"ecosystem",{"version":47,"is_range":48,"range_type":49,"version_start":9,"version_start_type":9,"version_end":9,"version_end_type":9,"fixed_in":9},{"version":52,"is_range":48,"range_type":49,"version_start":9,"version_start_type":9,"version_end":53,"version_end_type":54,"fixed_in":9},"lt6_12_13_1","6.12.13-1","excluding",{"version":52,"is_range":48,"range_type":49,"version_start":9,"version_start_type":9,"version_end":53,"version_end_type":54,"fixed_in":9}]