Vulnerability-Lookup

GHSA-PWXF-VP8F-F327

Vulnerability from github – Published: 2025-03-27 15:31 – Updated: 2025-07-06 12:30

Details

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix use-after-free on inode when scanning root during em shrinking

At btrfs_scan_root() we are accessing the inode's root (and fs_info) in a call to btrfs_fs_closing() after we have scheduled the inode for a delayed iput, and that can result in a use-after-free on the inode in case the cleaner kthread does the iput before we dereference the inode in the call to btrfs_fs_closing().

Fix this by using the fs_info stored already in a local variable instead of doing inode->root->fs_info.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-21879"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-416"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-27T15:15:55Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free on inode when scanning root during em shrinking\n\nAt btrfs_scan_root() we are accessing the inode\u0027s root (and fs_info) in a\ncall to btrfs_fs_closing() after we have scheduled the inode for a delayed\niput, and that can result in a use-after-free on the inode in case the\ncleaner kthread does the iput before we dereference the inode in the call\nto btrfs_fs_closing().\n\nFix this by using the fs_info stored already in a local variable instead\nof doing inode-\u003eroot-\u003efs_info.",
  "id": "GHSA-pwxf-vp8f-f327",
  "modified": "2025-07-06T12:30:24Z",
  "published": "2025-03-27T15:31:11Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21879"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/07836bc18f4ae42da4e922244f4685561c18755e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/59f37036bb7ab3d554c24abc856aabca01126414"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5e79d26014f9386387575b9ed60d342057cee49b"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2025-21879 (GCVE-0-2025-21879)

Vulnerability from cvelistv5 – Published: 2025-03-27 14:57 – Updated: 2026-08-05 11:55

Title

btrfs: fix use-after-free on inode when scanning root during em shrinking

Summary

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free on inode when scanning root during em shrinking At btrfs_scan_root() we are accessing the inode's root (and fs_info) in a call to btrfs_fs_closing() after we have scheduled the inode for a delayed iput, and that can result in a use-after-free on the inode in case the cleaner kthread does the iput before we dereference the inode in the call to btrfs_fs_closing(). Fix this by using the fs_info stored already in a local variable instead of doing inode->root->fs_info.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-28 15:22 UTC

CWE

CWE-416 - Use After Free

Assigner

Linux CNA under the mitre root

CNA scorecard D 54/100 over 6618 records in the last 180 days details

References

3 references

URL	Tags
https://git.kernel.org/stable/c/07836bc18f4ae42da…
https://git.kernel.org/stable/c/5e79d26014f938638…
https://git.kernel.org/stable/c/59f37036bb7ab3d55…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: fef55c4d9c9c22264d2b2ceae1e26922cb6129a5 , < 07836bc18f4ae42da4e922244f4685561c18755e (git) Affected: 1020443840569535f6025a855958f07ea3eebf71 , < 5e79d26014f9386387575b9ed60d342057cee49b (git) Affected: 1020443840569535f6025a855958f07ea3eebf71 , < 59f37036bb7ab3d554c24abc856aabca01126414 (git)
Linux	Linux	Affected: 6.13 Unaffected: 0 , < 6.13 (semver) Unaffected: 6.13.6 , ≤ 6.13.* (semver) Unaffected: 6.14 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21879",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-28T15:22:49.038837Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-28T15:31:59.926Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/extent_map.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "07836bc18f4ae42da4e922244f4685561c18755e",
              "status": "affected",
              "version": "fef55c4d9c9c22264d2b2ceae1e26922cb6129a5",
              "versionType": "git"
            },
            {
              "lessThan": "5e79d26014f9386387575b9ed60d342057cee49b",
              "status": "affected",
              "version": "1020443840569535f6025a855958f07ea3eebf71",
              "versionType": "git"
            },
            {
              "lessThan": "59f37036bb7ab3d554c24abc856aabca01126414",
              "status": "affected",
              "version": "1020443840569535f6025a855958f07ea3eebf71",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/extent_map.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.6",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free on inode when scanning root during em shrinking\n\nAt btrfs_scan_root() we are accessing the inode\u0027s root (and fs_info) in a\ncall to btrfs_fs_closing() after we have scheduled the inode for a delayed\niput, and that can result in a use-after-free on the inode in case the\ncleaner kthread does the iput before we dereference the inode in the call\nto btrfs_fs_closing().\n\nFix this by using the fs_info stored already in a local variable instead\nof doing inode-\u003eroot-\u003efs_info."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable `btrfs_extent_map_shrinker_worker` is reached only through the superblock shrinker (`btrfs_free_cached_objects()` \u2192 `btrfs_free_extent_maps()`) on a locally mounted btrfs filesystem, so the attacker must be able to generate local file I/O and memory pressure. No remote protocol data is parsed on this path.\nAC:L - The attacker drives both sides of the race \u2014 memory pressure queues the em shrinker work while concurrent unlink/subvolume-delete churn keeps the cleaner kthread active \u2014 and `btrfs_add_delayed_iput()` itself calls `wake_up_process(fs_info-\u003ecleaner_kthread)` immediately before the dangling dereference, so no attacker-uncontrollable timing is needed. Every inode the shrinker scans is a fresh attempt and the workload can be repeated indefinitely.\nPR:L - Any unprivileged local user with write access to a btrfs filesystem (the default root fs on Fedora, openSUSE, SteamOS and many NAS/appliance images, and common for container overlay storage) can populate extent maps and drive reclaim; there is no capability check, LSM gate, or admin-only ioctl anywhere on the path.\nUI:N - The attacker\u0027s own filesystem activity and memory-pressure workload trigger the shrinker worker and the cleaner kthread; no victim needs to mount, open, or otherwise interact with anything.\nS:U - The use-after-free occurs in a kernel workqueue worker against kernel slab memory within the same security authority as the vulnerable kernel; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a CWE-416 use-after-free where the freed `btrfs_inode` slab object is dereferenced as a pointer chain (`inode-\u003eroot-\u003efs_info`); an attacker who grooms `btrfs_inode_cachep` via concurrent inode allocation controls the contents at that offset, turning the dereference into a read at an attacker-influenced kernel address, and UAF windows on a dedicated inode cache are a well-established primitive for kernel memory disclosure.\nI:H - Use-after-free on a live slab object gives the attacker a dangling reference into memory that is concurrently reallocated and written by other inodes, which combined with heap grooming is the standard basis for corrupting adjacent kernel state and hijacking control flow. Scored high per the memory-corruption guidance rather than limited to the immediate observed symptom.\nA:H - Reading `inode-\u003eroot` from the reallocated object commonly yields NULL (set by `btrfs_alloc_inode()`, and guaranteed under `init_on_free=1`) or garbage, producing a kernel oops in the em shrinker worker; with KASAN enabled it is a slab-use-after-free splat that panics under `panic_on_warn`."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:55:04.752Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/07836bc18f4ae42da4e922244f4685561c18755e"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e79d26014f9386387575b9ed60d342057cee49b"
        },
        {
          "url": "https://git.kernel.org/stable/c/59f37036bb7ab3d554c24abc856aabca01126414"
        }
      ],
      "title": "btrfs: fix use-after-free on inode when scanning root during em shrinking",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21879",
    "datePublished": "2025-03-27T14:57:08.929Z",
    "dateReserved": "2024-12-29T08:45:45.782Z",
    "dateUpdated": "2026-08-05T11:55:04.752Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-PWXF-VP8F-F327

CVE-2025-21879 (GCVE-0-2025-21879)

Tags

Sightings

Nomenclature

Related by attack behaviour