CVE-2021-46958: 
Linux Kernel vulnerability analysis and mitigation

CVE-2021-46958 is a race condition vulnerability in the Linux kernel's BTRFS filesystem that leads to a use-after-free condition. The vulnerability exists between a task aborting a transaction during a commit, a task doing an fsync, and the transaction kthread. This vulnerability affects Linux kernel versions from 5.7 up to (excluding) 5.10.36, from 5.11 up to (excluding) 5.11.20, and from 5.12 up to (excluding) 5.12.3 (NVD).

The vulnerability occurs in the BTRFS filesystem when there is a race between transaction handling and fsync operations. The issue manifests when one task aborts a transaction during commit while another task is performing an fsync operation, leading to a use-after-free of the log root tree. The vulnerability has a CVSS v3.1 Base Score of 4.7 (Medium) with vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can result in a system crash due to the use-after-free condition, leading to a denial of service. The issue manifests through a general protection fault and can force the filesystem into a readonly state (Kernel Patch).

The vulnerability requires local access and high complexity to exploit. It can be triggered during specific filesystem operations involving transaction commits and fsync operations. The vulnerability has been confirmed to be exploitable through filesystem stress testing (NVD).

The vulnerability has been fixed in Linux kernel versions 5.10.36, 5.11.20, and 5.12.3. The fix involves modifying the transaction cleanup process to ensure proper synchronization between transaction abort operations and fsync operations. The patch changes the timing of when transactions are removed from the list of transactions during cleanup (Kernel Patch).