An error due to a double decrement of reference count was found in btrfs_get_root_ref in fs/btrfs/disk-io.c in btrfs filesystem in the Linux Kernel. In this flaw a local attacker with user privilege may lead to a system crash or may leak internal kernel information. In btrfs_get_root_ref(), when btrfs_insert_fs_root() fails, btrfs_put_root() will be called to possibly free the memory area of the variable root. However, this variable is then used again in error handling code after "goto fail", when ret is not -EEXIST. References: https://patchwork.kernel.org/project/linux-btrfs/patch/20220324134454.15192-1-baijiaju1990@gmail.com/
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2023-4389