CVE-2024-57806: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-57806 is a transaction atomicity bug in the Linux kernel's BTRFS filesystem that affects the simple quota feature. The vulnerability was discovered and disclosed on January 11, 2025. The issue occurs when enabling simple quotas in BTRFS, where the incompat bit BTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA is set after committing the transaction that enables the feature, leading to potential inconsistencies (Kernel Git).

The vulnerability manifests when enabling quotas in BTRFS, specifically during the btrfs_quota_enable() function execution. The bug occurs because BTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE is set at fs_info->qgroup_flags and persisted in the quota root with the BTRFS_QGROUP_STATUS_KEY, but the incompat bit BTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA is only set after committing the transaction. With CONFIG_BTRFS_ASSERT enabled, this triggers an assertion failure at btrfs_read_qgroup_config() -> qgroup_read_enable_gen() (NVD).

If the filesystem is unmounted without starting and committing any other transaction after the initial quota enabling transaction, or if a power failure occurs, the next mount operation will find inconsistent states between the BTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE flag and the BTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA bit, leading to an assertion failure (Kernel Git).

The issue can be reproduced using a simple sequence of commands: creating a BTRFS filesystem, mounting it, enabling simple quotas, unmounting, and remounting the filesystem (Debian Security).

The fix involves setting the BTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA flag immediately after setting the BTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE, ensuring both flags are flushed to disk within the same transaction. This patch has been merged into the Linux kernel (Kernel Git).