{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-21879", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.782Z", "datePublished": "2025-03-27T14:57:08.929Z", "dateUpdated": "2026-08-05T11:55:04.752Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:55:04.752Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free on inode when scanning root during em shrinking\n\nAt btrfs_scan_root() we are accessing the inode's root (and fs_info) in a\ncall to btrfs_fs_closing() after we have scheduled the inode for a delayed\niput, and that can result in a use-after-free on the inode in case the\ncleaner kthread does the iput before we dereference the inode in the call\nto btrfs_fs_closing().\n\nFix this by using the fs_info stored already in a local variable instead\nof doing inode->root->fs_info." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable `btrfs_extent_map_shrinker_worker` is reached only through the superblock shrinker (`btrfs_free_cached_objects()` → `btrfs_free_extent_maps()`) on a locally mounted btrfs filesystem, so the attacker must be able to generate local file I/O and memory pressure. No remote protocol data is parsed on this path.\nAC:L - The attacker drives both sides of the race — memory pressure queues the em shrinker work while concurrent unlink/subvolume-delete churn keeps the cleaner kthread active — and `btrfs_add_delayed_iput()` itself calls `wake_up_process(fs_info->cleaner_kthread)` immediately before the dangling dereference, so no attacker-uncontrollable timing is needed. Every inode the shrinker scans is a fresh attempt and the workload can be repeated indefinitely.\nPR:L - Any unprivileged local user with write access to a btrfs filesystem (the default root fs on Fedora, openSUSE, SteamOS and many NAS/appliance images, and common for container overlay storage) can populate extent maps and drive reclaim; there is no capability check, LSM gate, or admin-only ioctl anywhere on the path.\nUI:N - The attacker's own filesystem activity and memory-pressure workload trigger the shrinker worker and the cleaner kthread; no victim needs to mount, open, or otherwise interact with anything.\nS:U - The use-after-free occurs in a kernel workqueue worker against kernel slab memory within the same security authority as the vulnerable kernel; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a CWE-416 use-after-free where the freed `btrfs_inode` slab object is dereferenced as a pointer chain (`inode->root->fs_info`); an attacker who grooms `btrfs_inode_cachep` via concurrent inode allocation controls the contents at that offset, turning the dereference into a read at an attacker-influenced kernel address, and UAF windows on a dedicated inode cache are a well-established primitive for kernel memory disclosure.\nI:H - Use-after-free on a live slab object gives the attacker a dangling reference into memory that is concurrently reallocated and written by other inodes, which combined with heap grooming is the standard basis for corrupting adjacent kernel state and hijacking control flow. Scored high per the memory-corruption guidance rather than limited to the immediate observed symptom.\nA:H - Reading `inode->root` from the reallocated object commonly yields NULL (set by `btrfs_alloc_inode()`, and guaranteed under `init_on_free=1`) or garbage, producing a kernel oops in the em shrinker worker; with KASAN enabled it is a slab-use-after-free splat that panics under `panic_on_warn`." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/btrfs/extent_map.c" ], "versions": [ { "version": "fef55c4d9c9c22264d2b2ceae1e26922cb6129a5", "lessThan": "07836bc18f4ae42da4e922244f4685561c18755e", "status": "affected", "versionType": "git" }, { "version": "1020443840569535f6025a855958f07ea3eebf71", "lessThan": "5e79d26014f9386387575b9ed60d342057cee49b", "status": "affected", "versionType": "git" }, { "version": "1020443840569535f6025a855958f07ea3eebf71", "lessThan": "59f37036bb7ab3d554c24abc856aabca01126414", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/btrfs/extent_map.c" ], "versions": [ { "version": "6.13", "status": "affected" }, { "version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver" }, { "version": "6.13.6", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.13.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.14" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/07836bc18f4ae42da4e922244f4685561c18755e" }, { "url": "https://git.kernel.org/stable/c/5e79d26014f9386387575b9ed60d342057cee49b" }, { "url": "https://git.kernel.org/stable/c/59f37036bb7ab3d554c24abc856aabca01126414" } ], "title": "btrfs: fix use-after-free on inode when scanning root during em shrinking", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "metrics": [ { "cvssV3_1": { "scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH" } }, { "other": { "type": "ssvc", "content": { "id": "CVE-2025-21879", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "version": "2.0.3", "timestamp": "2025-03-28T15:22:49.038837Z" } } } ], "problemTypes": [ { "descriptions": [ { "lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free" } ] } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-28T15:31:59.926Z" } } ] } }