{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-39800", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.133Z", "datePublished": "2025-09-15T12:36:43.043Z", "dateUpdated": "2026-08-05T12:05:16.237Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:05:16.237Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: abort transaction on unexpected eb generation at btrfs_copy_root()\n\nIf we find an unexpected generation for the extent buffer we are cloning\nat btrfs_copy_root(), we just WARN_ON() and don't error out and abort the\ntransaction, meaning we allow to persist metadata with an unexpected\ngeneration. Instead of warning only, abort the transaction and return\n-EUCLEAN." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - btrfs is a local filesystem; the vulnerable code is reached through the `BTRFS_IOC_SNAP_CREATE`/`SNAP_CREATE_V2` ioctl path or through relocation on a locally mounted volume. No remote peer data or network protocol handler reaches `btrfs_copy_root()`.\nAC:L - Once the volume carries a tree block with a future generation — a state the attacker authors directly in a crafted image, or that pre-exists from bit rot or an earlier bug — the trigger is a single deterministic ioctl with no race to win and no memory layout to groom. The attacker controls both the on-disk state and the snapshot request, so nothing is beyond their influence.\nPR:L - `__btrfs_ioctl_snap_create()` gates snapshots only on `inode_owner_or_capable()` against the source subvolume, and plain subvolume creation is explicitly unrestricted, so any unprivileged user with write access to a btrfs mount can create a subvolume and then snapshot it to drive `create_pending_snapshot()` into `btrfs_copy_root()`.\nUI:N - The attacker issues the snapshot ioctl themselves against a filesystem that is already mounted, and the balance/relocation path likewise runs without any victim action. No one has to open a file or mount anything at exploitation time.\nS:U - The mishandled metadata, the corrupted extent tree, and the resulting crashes all stay within the kernel's own security authority on the same host; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - Persisting the clone means the bogus-generation block later makes `btrfs_block_can_be_shared()` return false (`buf_gen > btrfs_root_last_snapshot()`), so COW skips ref accounting for a block the new snapshot references; extents are subsequently freed while still in use and reallocated to other files, letting the attacker read data belonging to other users through their own subvolume.\nI:H - The kernel writes metadata it has already recognised as invalid, and the resulting extent-refcount divergence causes in-use blocks to be handed out to unrelated files — arbitrary, persistent corruption of other users' file contents and of filesystem metadata that survives reboot.\nA:H - The `WARN_ON()` alone is an immediate panic under `panic_on_warn`, and the corrupted metadata that gets committed makes later tree reads fail the parent-transid check, leaving the filesystem unmountable or forcing it read-only — a persistent denial of service the attacker can trigger at will." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/btrfs/ctree.c" ], "versions": [ { "version": "be20aa9dbadc8c06283784ee12bbc0d97dea3418", "lessThan": "4290e34fb87ae556b12c216efd0ae91583446b7a", "status": "affected", "versionType": "git" }, { "version": "be20aa9dbadc8c06283784ee12bbc0d97dea3418", "lessThan": "4734255ef39b416864139dcda96a387fe5f33a6a", "status": "affected", "versionType": "git" }, { "version": "be20aa9dbadc8c06283784ee12bbc0d97dea3418", "lessThan": "da2124719f386b6e5d4d4b1a2e67c440e4d5892f", "status": "affected", "versionType": "git" }, { "version": "be20aa9dbadc8c06283784ee12bbc0d97dea3418", "lessThan": "f4f5bd9251a4cbe55aaa05725c6c3c32ad1f74b3", "status": "affected", "versionType": "git" }, { "version": "be20aa9dbadc8c06283784ee12bbc0d97dea3418", "lessThan": "33e8f24b52d2796b8cfb28c19a1a7dd6476323a8", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/btrfs/ctree.c" ], "versions": [ { "version": "2.6.29", "status": "affected" }, { "version": "0", "lessThan": "2.6.29", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.149", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.103", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.44", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16.4", "lessThanOrEqual": "6.16.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.1.149" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.6.103" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.12.44" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.16.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.29", "versionEndExcluding": "6.17" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/4290e34fb87ae556b12c216efd0ae91583446b7a" }, { "url": "https://git.kernel.org/stable/c/4734255ef39b416864139dcda96a387fe5f33a6a" }, { "url": "https://git.kernel.org/stable/c/da2124719f386b6e5d4d4b1a2e67c440e4d5892f" }, { "url": "https://git.kernel.org/stable/c/f4f5bd9251a4cbe55aaa05725c6c3c32ad1f74b3" }, { "url": "https://git.kernel.org/stable/c/33e8f24b52d2796b8cfb28c19a1a7dd6476323a8" } ], "title": "btrfs: abort transaction on unexpected eb generation at btrfs_copy_root()", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:43:30.834Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T12:07:08.998Z" }, "affected": [ { "vendor": "Siemens", "product": "SIMATIC CN 4100", "versions": [ { "status": "affected", "version": "0", "lessThan": "V5.0", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ] } ] } }