CVE-2024-35956: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel's BTRFS filesystem has been identified as CVE-2024-35956. The issue affects the quota groups (squota or qgroups) functionality when performing subvolume operations. The vulnerability was discovered in May 2024 and affects the BTRFS filesystem implementation in the Linux kernel (NVD).

The vulnerability occurs in the handling of qgroup PREALLOC reservations during subvolume operations (create subvolume, create snapshot, and delete subvolume). When quota groups are enabled, these operations reserve qgroup metadata of type PREALLOC, which should be converted to PERTRANS once associated with a transaction. However, the error paths were incorrectly implementing this lifecycle, unconditionally converting PREALLOC to PERTRANS regardless of errors or transaction association status. This resulted in occasional leaks of PERTRANS reservations when record_root_in_trans was not called successfully (Kernel Commit).

The vulnerability leads to memory leaks in the BTRFS filesystem when performing subvolume operations with quota groups enabled. In debug builds (CONFIG_BTRFS_DEBUG), this manifests as a WARN at unmount due to leaked reservations. The issue primarily affects system stability and resource management (Kernel Commit).

The vulnerability requires local access to a system running BTRFS with quota groups enabled. It is triggered during specific filesystem operations (subvolume creation, snapshot creation, or deletion). Testing showed the issue would manifest in approximately 5-10 runs under specific conditions (Kernel Commit).

A fix has been implemented that ensures proper handling of qgroup PREALLOC reservations by enforcing two key properties: 1) any failure before record_root_in_trans is called successfully results in freeing the PREALLOC reservation, and 2) after record_root_in_trans, conversion to PERTRANS occurs with transaction ownership of freeing the reservation. The fix has been extensively tested, with 1000 successful consecutive runs reported (Kernel Commit).