CVE-2024-57975 is a vulnerability identified in the Linux kernel's Btrfs (B-tree file system) implementation, specifically related to the handling of delayed allocation (delalloc) and copy-on-write (COW) operations. The issue arises in the function run_delalloc_nocow(), which is responsible for managing non-COW writes to preallocated extents. When run_delalloc_nocow() encounters an error during a fallback COW operation (cow_file_range()), it improperly handles folio (a memory management unit representing a group of pages) cleanup. This improper cleanup leads to folios being unlocked prematurely and marked for writeback without proper locking, triggering kernel BUGs and potential system crashes. The root cause is that the error handling path in run_delalloc_nocow() does not clear the folio dirty flags correctly and attempts to mark folios as writeback while they are unlocked, violating kernel memory management invariants. This bug manifests as kernel panics or oopses, particularly under configurations with CONFIG_DEBUG_VM enabled, and can be triggered by specific workloads that stress Btrfs's delayed allocation and COW mechanisms. The fix involves introducing helper functions to properly clear dirty folios, manage writeback states, and track failed COW ranges to avoid double unlocking. These changes ensure folios are correctly locked and cleaned up even when errors occur, preventing the kernel from crashing due to improper memory state transitions. The vulnerability affects Linux kernel versions including the 6.12.0-rc7 release candidate and potentially other versions using the affected Btrfs code paths. No known exploits are reported in the wild at this time.

For European organizations, this vulnerability poses a risk primarily to systems running Linux with Btrfs file systems, especially those using kernel versions around 6.12.0-rc7 or similar development releases. The impact is mainly on system stability and availability, as exploitation leads to kernel crashes (kernel BUGs) and potential denial of service (DoS) conditions. Organizations relying on Btrfs for critical storage, such as data centers, cloud providers, and enterprises using Linux servers for file storage or virtualization, could experience unexpected downtime or data access interruptions. While this vulnerability does not directly expose confidentiality or integrity risks, the resulting system instability can disrupt business operations and cause data loss if crashes occur during write operations. Given the increasing adoption of Btrfs in enterprise Linux distributions and cloud environments, the threat is relevant to European entities with Linux infrastructure. The absence of known exploits reduces immediate risk, but the complexity of the bug and its manifestation under specific workloads mean that thorough testing and patching are essential to maintain operational continuity.

European organizations should take the following specific mitigation steps: 1) Identify all Linux systems using Btrfs file systems, particularly those running kernel versions near 6.12.0-rc7 or other recent development kernels. 2) Apply the official Linux kernel patches that address CVE-2024-57975 as soon as they become available from trusted sources or Linux distribution vendors. 3) If immediate patching is not feasible, consider temporarily disabling Btrfs or migrating critical data to alternative stable file systems (e.g., ext4 or XFS) to avoid triggering the vulnerable code paths. 4) Enable and monitor kernel logs for VM_BUG_ON_FOLIO or related Btrfs error messages to detect early signs of the issue. 5) Conduct stress testing of Btrfs workloads in controlled environments to identify potential crash triggers before deploying to production. 6) Maintain up-to-date backups of critical data to mitigate risks of data loss due to unexpected crashes. 7) Coordinate with Linux distribution maintainers and security teams to track patch releases and advisories related to this vulnerability. These targeted actions go beyond generic advice by focusing on the specific kernel versions, file system usage, and error symptoms associated with this vulnerability.