CVE-2024-26644 is a vulnerability identified in the Linux kernel's Btrfs filesystem implementation. The flaw occurs when attempting to create a snapshot of a deleted subvolume. Specifically, the function create_pending_snapshot() initializes a new root item by copying the source root item, including the 'refs' field. For deleted subvolumes, this 'refs' field is zero. When btrfs_insert_root() inserts a root with refs == 0, subsequent calls to btrfs_get_new_fs_root() detect this and return an error (-ENOENT), causing create_pending_snapshot() to abort the transaction. This abort leads to the filesystem entering a forced readonly state and skipping the commit of the aborted transaction, effectively disrupting normal filesystem operations. The root cause is a lack of validation of the source root's refs count before snapshot creation, which can be exploited by referencing a deleted subvolume. The fix involves adding a check on the source root's refs after acquiring the subvol_sem lock to prevent race conditions with deletion. This vulnerability does not appear to be exploited in the wild yet and affects Linux kernel versions including the commit identified by hash 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2. The issue manifests as a denial of service (DoS) condition by aborting filesystem transactions and forcing the Btrfs filesystem into a readonly state, potentially impacting system stability and availability.

For European organizations, this vulnerability poses a risk primarily to systems utilizing the Btrfs filesystem on Linux kernels affected by this flaw. Btrfs is increasingly used in enterprise and cloud environments due to its advanced features like snapshots and volume management. The vulnerability can cause denial of service by aborting filesystem transactions and forcing the filesystem into a readonly state, which can disrupt critical applications, data processing, and services relying on Btrfs volumes. Organizations running virtualized environments or container platforms on Linux with Btrfs-backed storage could experience service interruptions. Additionally, since the issue arises from snapshot operations, backup and recovery workflows that rely on Btrfs snapshots may be impacted, potentially delaying disaster recovery or data protection processes. Although exploitation requires invoking snapshot ioctl calls referencing deleted subvolumes, which implies local access or privileged operations, the impact on availability and operational continuity can be significant. This could affect sectors with high reliance on Linux infrastructure such as finance, telecommunications, research institutions, and government agencies across Europe.

European organizations should prioritize updating their Linux kernels to versions where this vulnerability is patched, ensuring the fix that validates the refs field before snapshot creation is applied. System administrators should audit their use of Btrfs snapshots, especially in automated scripts or backup systems, to avoid referencing deleted subvolumes. Implementing strict access controls and limiting privileged user operations that can invoke snapshot ioctl calls will reduce the risk of accidental or malicious triggering of this vulnerability. Monitoring kernel logs for Btrfs-related errors or warnings can help detect attempts to exploit this issue. For environments where immediate patching is not feasible, temporarily disabling snapshot creation on Btrfs volumes or restricting it to trusted users can mitigate risk. Additionally, maintaining regular backups outside of Btrfs snapshots ensures data availability if the filesystem enters readonly mode. Organizations should also engage with their Linux distribution vendors to receive timely updates and security advisories related to this vulnerability.