7.8

CVE-2025-21879

btrfs: fix use-after-free on inode when scanning root during em shrinking

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix use-after-free on inode when scanning root during em shrinking

At btrfs_scan_root() we are accessing the inode's root (and fs_info) in a
call to btrfs_fs_closing() after we have scheduled the inode for a delayed
iput, and that can result in a use-after-free on the inode in case the
cleaner kthread does the iput before we dereference the inode in the call
to btrfs_fs_closing().

Fix this by using the fs_info stored already in a local variable instead
of doing inode->root->fs_info.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 6.13 < 6.13.6
Linux ≫ Linux Kernel Version 6.14 Update rc1
Linux ≫ Linux Kernel Version 6.14 Update rc2
Linux ≫ Linux Kernel Version 6.14 Update rc3
Linux ≫ Linux Kernel Version 6.14 Update rc4
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.2% 0.096
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

https://git.kernel.org/stable/c/5e79d26014f9386387575b9ed60d342057cee49b
Patch
https://git.kernel.org/stable/c/59f37036bb7ab3d554c24abc856aabca01126414
Patch
https://git.kernel.org/stable/c/07836bc18f4ae42da4e922244f4685561c18755e