Answer in brief
CVE-2024-50273 records a High severity (CVSS 7.8) vulnerability in btrfs: reinitialize delayed ref list after deleting it from the list. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1d57ee941692d0cc928526e21a1557b2ae3e11db <2fd0948a483e9cb2d669c7199bc620a21c97673d || >=1d57ee941692d0cc928526e21a1557b2ae3e11db <93c5b8decc0ef39ba84f4211d2db6da0a4aefbeb || >=1d57ee941692d0cc928526e21a1557b2ae3e11db <bf0b0c6d159767c0d1c21f793950d78486690ee0 || >=1d57ee941692d0cc928526e21a1557b2ae3e11db <c24fa427fc0ae827b2a3a07f13738cbf82c3f851 || >=1d57ee941692d0cc928526e21a1557b2ae3e11db <2cb1a73d1d44a1c11b0ee5eeced765dd80ec48e6 || >=1d57ee941692d0cc928526e21a1557b2ae3e11db <f04be6d68f715c1473a8422fc0460f57b5e99931 || >=1d57ee941692d0cc928526e21a1557b2ae3e11db <50a3933760b427759afdd23156a7280a19357a92 || >=1d57ee941692d0cc928526e21a1557b2ae3e11db <c9a75ec45f1111ef530ab186c2a7684d0a0c9245 | 2fd0948a483e9cb2d669c7199bc620a21c97673d, 93c5b8decc0ef39ba84f4211d2db6da0a4aefbeb, bf0b0c6d159767c0d1c21f793950d78486690ee0, c24fa427fc0ae827b2a3a07f13738cbf82c3f851, 2cb1a73d1d44a1c11b0ee5eeced765dd80ec48e6, f04be6d68f715c1473a8422fc0460f57b5e99931, 50a3933760b427759afdd23156a7280a19357a92, c9a75ec45f1111ef530ab186c2a7684d0a0c9245 |
| Linux/Linuxgeneric | 4.10 | Not reported |
Published upstream
Nov 19, 2024
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: btrfs: reinitialize delayed ref list after deleting it from the list At insert_delayed_ref() if we need to update the action of an existing ref to BTRFS_DROP_DELAYED_REF, we delete the ref from its ref head's ref_add_list using list_del(), which leaves the ref's add_list member not reinitialized, as list_del() sets the next and prev members of the list to LIST_POISON1 and LIST_POISON2, respectively. If later we end up calling drop_delayed_ref() against the ref, which can happen during merging or when destroying delayed refs due to a transaction abort, we can trigger a crash since at drop_delayed_ref() we call list_empty() against the ref's add_list, which returns false since the list was not reinitialized after the list_del() and as a consequence we call list_del() again at drop_delayed_ref(). This results in an invalid list access since the next and prev members are set to poison pointers, resulting in a splat if CONFIG_LIST_HARDENED and CONFIG_DEBUG_LIST are set or invalid poison pointer dereferences otherwise. So fix this by deleting from the list with list_del_init() instead.
Quoted source text, attributed separately from HOL analysis.