CVE-2024-26792: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-26792 is a double-free vulnerability discovered in the BTRFS filesystem component of the Linux kernel. The issue occurs during snapshot creation when there's a failure in committing the transaction, which can lead to a double free of an anonymous device. This vulnerability was disclosed on April 4, 2024, and affects multiple versions of the Linux kernel (NVD).

The vulnerability stems from a race condition in the snapshot creation process where an anonymous device number may be freed twice. The issue occurs in the following sequence: 1) An anonymous device number is allocated and assigned to pending_snapshot->anon_dev in ioctl.c:create_snapshot(), 2) During btrfs_commit_transaction() execution, the code reaches transaction.c:create_pending_snapshot(), 3) The anonymous device number is freed when btrfs_get_new_fs_root() is called because btrfs_lookup_fs_root() returns an existing root, 4) If an error occurs in the transaction commit path, the same anonymous device number is freed again at the 'fail' label. The CVSS v3.1 base score for this vulnerability is 7.8 (HIGH) with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

The double-free vulnerability can result in freeing an anonymous device number that may have been reallocated to another subsystem in the kernel or another BTRFS filesystem. This could potentially lead to system instability, denial of service, or possible arbitrary code execution (Kernel Patch).

The vulnerability requires local access with low privileges to exploit. It can be triggered during BTRFS snapshot creation operations when specific error conditions occur. The issue has been confirmed through testing with syzbot, which reported the vulnerability through a kernel warning message indicating an attempt to free an already freed anonymous device number (Kernel Patch).

The vulnerability has been fixed in the Linux kernel through patches that modify the btrfs_get_root_ref() function and its callers to use a dev_t pointer argument for the anonymous device number. This ensures that when the number is freed, it's also reset to 0, preventing the double-free condition. The fix has been backported to multiple kernel versions including 5.10.210, 5.15.149, 6.1.79, 6.6.18, and 6.7.6 (NVD).