Executive brief
The Linux kernel's btrfs (B-tree file system) implementation contains a race condition when deleting the free space tree. An attacker or concurrent filesystem operation could trigger memory corruption and system crashes by exploiting unsynchronized access to internal filesystem structures. This can lead to denial of service and potential data loss on systems using btrfs storage.
Technical details
This is a race condition vulnerability in the btrfs filesystem code (CWE-366: Race Condition). The vulnerable function deletes the free space root from the fs_info->dirty_cowonly_roots list without holding the trans_lock mutex that protects concurrent access. When another process simultaneously manipulates this list via add_root_to_dirty_list(), list corruption occurs, leading to invalid pointer dereferences and general protection faults. The vulnerability is locally exploitable through filesystem operations (balance operations, transaction commits) and can cause kernel panics. A patch is available in the Linux kernel source that adds proper locking around the list deletion.
Affected products
- Linux Linux kernel kernel versions prior to the fix (approximately 6.4.0-rc6 and earlier)
Timeline
- 2025-12-24: disclosed