CVE-2024-41067 is a vulnerability identified in the Linux kernel's Btrfs filesystem scrub functionality. The issue arises specifically in the handling of the RAID Stripe Table (RST) lookup errors during the scrub operation, which is a process designed to verify and repair data integrity on Btrfs volumes. The vulnerability is triggered when the scrub process attempts to read a sector that is not properly mapped due to a failure in the btrfs_map_block() function call. In the flawed implementation, a bio buffer (bbio) is allocated before verifying the mapping, and if btrfs_map_block() fails, the bio is empty but still processed. This leads to an assertion failure (ASSERT(sector_nr < stripe->nr_sectors)) inside scrub_read_endio(), causing a kernel crash. The root cause is that the scrub code does not correctly handle the case where the RST lookup fails, resulting in an empty bio vector that triggers the assertion. The fix involves changing the order of operations to call btrfs_map_block() before allocating the bio, preventing the creation of empty bios and avoiding the race condition where the scrub process could hang indefinitely due to a pending_io counter not being decremented. Although this patch resolves the immediate crash and race condition, the underlying cause of the RST lookup failure remains unaddressed. This vulnerability affects Linux kernel versions identified by the given commit hashes and is relevant to systems using Btrfs with forced RST features enabled during scrub operations. No known exploits are reported in the wild as of the publication date.

For European organizations, the impact of CVE-2024-41067 can be significant in environments relying on Btrfs filesystems, particularly those using the scrub feature with forced RST enabled. The vulnerability can cause kernel crashes leading to system instability or downtime, which affects availability. In critical infrastructure, data centers, or enterprise environments where Linux servers run Btrfs for storage, such crashes could disrupt services, cause data unavailability, and require system reboots or manual intervention. Although the vulnerability does not directly expose confidentiality or integrity risks, the denial-of-service potential through kernel panics can impact business continuity. Organizations with automated scrub processes for data integrity verification may experience unexpected failures, complicating maintenance and monitoring. Since no exploits are known in the wild, the immediate risk is moderate; however, the presence of a kernel panic vulnerability in a core filesystem component warrants prompt attention to avoid potential exploitation or accidental outages.

European organizations should prioritize updating their Linux kernels to versions containing the fix for CVE-2024-41067 as soon as patches are available. Specifically, ensure that the kernel version includes the corrected scrub code that calls btrfs_map_block() prior to bio allocation. In the interim, organizations can mitigate risk by disabling forced RST features during scrub operations if feasible, or by limiting scrub operations to non-production windows to reduce the impact of potential crashes. Monitoring kernel logs for scrub-related assertion failures or crashes can help detect attempts to trigger this vulnerability. Additionally, organizations should review their Btrfs usage and consider alternative filesystems if forced RST features are critical and patches are delayed. Implementing robust backup and recovery procedures will mitigate data availability risks in case of system crashes. Finally, maintain close coordination with Linux distribution vendors for timely patch deployment and advisories.