{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2024-57806",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2024-57806",
    "idYear": 2024,
    "status": "PUBLISHED",
    "publishedAt": "2025-01-11T12:39:52.628Z",
    "updatedAt": "2026-05-11T20:59:17.629Z",
    "importedAt": "2026-10-24T01:57:20.494Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "btrfs: fix transaction atomicity bug when enabling simple quotas",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix transaction atomicity bug when enabling simple quotas\n\nSet squota incompat bit before committing the transaction that enables\nthe feature.\n\nWith the config CONFIG_BTRFS_ASSERT enabled, an assertion\nfailure occurs regarding the simple quota feature.\n\n  [5.596534] assertion failed: btrfs_fs_incompat(fs_info, SIMPLE_QUOTA), in fs/btrfs/qgroup.c:365\n  [5.597098] ------------[ cut here ]------------\n  [5.597371] kernel BUG at fs/btrfs/qgroup.c:365!\n  [5.597946] CPU: 1 UID: 0 PID: 268 Comm: mount Not tainted 6.13.0-rc2-00031-gf92f4749861b #146\n  [5.598450] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\n  [5.599008] RIP: 0010:btrfs_read_qgroup_config+0x74d/0x7a0\n  [5.604303]  <TASK>\n  [5.605230]  ? btrfs_read_qgroup_config+0x74d/0x7a0\n  [5.605538]  ? exc_invalid_op+0x56/0x70\n  [5.605775]  ? btrfs_read_qgroup_config+0x74d/0x7a0\n  [5.606066]  ? asm_exc_invalid_op+0x1f/0x30\n  [5.606441]  ? btrfs_read_qgroup_config+0x74d/0x7a0\n  [5.606741]  ? btrfs_read_qgroup_config+0x74d/0x7a0\n  [5.607038]  ? try_to_wake_up+0x317/0x760\n  [5.607286]  open_ctree+0xd9c/0x1710\n  [5.607509]  btrfs_get_tree+0x58a/0x7e0\n  [5.608002]  vfs_get_tree+0x2e/0x100\n  [5.608224]  fc_mount+0x16/0x60\n  [5.608420]  btrfs_get_tree+0x2f8/0x7e0\n  [5.608897]  vfs_get_tree+0x2e/0x100\n  [5.609121]  path_mount+0x4c8/0xbc0\n  [5.609538]  __x64_sys_mount+0x10d/0x150\n\nThe issue can be easily reproduced using the following reproducer:\n\n  root@q:linux# cat repro.sh\n  set -e\n\n  mkfs.btrfs -q -f /dev/sdb\n  mount /dev/sdb /mnt/btrfs\n  btrfs quota enable -s /mnt/btrfs\n  umount /mnt/btrfs\n  mount /dev/sdb /mnt/btrfs\n\nThe issue is that when enabling quotas, at btrfs_quota_enable(), we set\nBTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE at fs_info->qgroup_flags and persist\nit in the quota root in the item with the key BTRFS_QGROUP_STATUS_KEY, but\nwe only set the incompat bit BTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA after we\ncommit the transaction used to enable simple quotas.\n\nThis means that if after that transaction commit we unmount the filesystem\nwithout starting and committing any other transaction, or we have a power\nfailure, the next time we mount the filesystem we will find the flag\nBTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE set in the item with the key\nBTRFS_QGROUP_STATUS_KEY but we will not find the incompat bit\nBTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA set in the superblock, triggering an\nassertion failure at:\n\n  btrfs_read_qgroup_config() -> qgroup_read_enable_gen()\n\nTo fix this issue, set the BTRFS_FEATURE_INCOMPAT_SIMPLE_QUOTA flag\nimmediately after setting the BTRFS_QGROUP_STATUS_FLAG_SIMPLE_MODE.\nThis ensures that both flags are flushed to disk within the same\ntransaction.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "182940f4f4dbd932776414744c8de64333957725",
              "status": "affected",
              "versionType": "git",
              "lessThan": "b87c9b9ba05ba6e8e2ee9ecd29a8c930b35648ed"
            },
            {
              "version": "182940f4f4dbd932776414744c8de64333957725",
              "status": "affected",
              "versionType": "git",
              "lessThan": "f2363e6fcc7938c5f0f6ac066fad0dd247598b51"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "6.7",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "6.7"
            },
            {
              "version": "6.12.8",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.13",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}