CVE-2024-40962 is a vulnerability identified in the Linux kernel's Btrfs filesystem implementation, specifically related to zoned block devices. Zoned block devices are a type of storage device that divides the media into zones, which must be written sequentially. The vulnerability arises in the handling of NODATASUM (no data checksum) writes on emulated zoned devices within the Btrfs filesystem. During such writes, the kernel fails to allocate dummy checksums properly, leading to a NULL pointer dereference in the function btrfs_zone_finish_endio(). This results in a general protection fault (kernel crash) due to dereferencing a null pointer, as demonstrated by the crash logs and kernel oops messages provided. The root cause is that for NOCOW (no copy-on-write) zoned data writes on conventional zones, the kernel only attaches dummy checksums if the write is a zone-append operation. However, emulated zoned devices simulate conventional zones on regular devices and do not use zone-append writes for NOCOW operations, causing the checksum list to be missing and triggering the crash. Enabling CONFIG_BTRFS_ASSERT reveals an assertion failure indicating the missing checksum list. The vulnerability was discovered during fstests' test-case btrfs/167 on emulated zoned devices. The fix involves ensuring that dummy checksums are attached for all NOCOW zoned data writes, not just zone-append writes. This vulnerability affects Linux kernel versions including the 6.10.0-rc2-kts+ release candidate and likely other versions with similar Btrfs zoned device handling code. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet.

The vulnerability can cause a kernel panic or system crash on Linux systems using the Btrfs filesystem with zoned block device support, particularly when performing NODATASUM writes on emulated zoned devices. For European organizations, especially those relying on Linux servers with Btrfs and zoned storage (such as advanced storage arrays or certain SSDs configured for zoned operation), this could lead to unexpected downtime, data unavailability, and potential disruption of critical services. While the vulnerability does not directly lead to privilege escalation or data corruption, the denial of service caused by kernel crashes can impact system availability and reliability. Organizations running virtualized environments or container platforms on Linux with Btrfs and zoned devices may experience cascading failures. Since the vulnerability requires specific conditions (NODATASUM writes on emulated zoned devices), the attack surface is somewhat limited, but systems using zoned storage for performance or endurance benefits are at risk. The lack of known exploits reduces immediate threat, but unpatched systems remain vulnerable to accidental crashes or potential targeted exploitation if attackers develop triggers. The impact on confidentiality and integrity is low, but availability impact is medium to high depending on the criticality of affected systems.

1. Apply the latest Linux kernel patches that address CVE-2024-40962 as soon as they become available from trusted sources or Linux distribution vendors. 2. Temporarily disable or avoid using zoned block devices with Btrfs on affected Linux kernel versions until patched. 3. Avoid performing NODATASUM writes on emulated zoned devices if possible, or switch to conventional storage devices without zoned emulation. 4. Monitor kernel logs for signs of btrfs_zone_finish_endio() related crashes or general protection faults indicative of this issue. 5. For organizations using custom or embedded Linux kernels, ensure kernel builds include the fix and test Btrfs zoned device functionality thoroughly. 6. Implement robust system monitoring and automated reboot/recovery procedures to minimize downtime in case of kernel panics. 7. Engage with hardware vendors to confirm compatibility and support for zoned devices and their interaction with Btrfs. 8. Consider alternative filesystems or storage configurations if zoned device support is not critical, to reduce exposure.