Executive brief
A vulnerability in the Linux kernel's Btrfs file system could allow a local user to cause a system crash or potentially execute unauthorized code. The issue occurs when the system attempts to manage file system transactions that have been cancelled, leading to a memory error. This could impact the stability of servers or workstations using Btrfs and potentially lead to data corruption or unauthorized access.
Technical details
A use-after-free (UAF) vulnerability exists in the Btrfs implementation within the Linux kernel, specifically in the join_transaction function in fs/btrfs/transaction.c. The root cause is a race condition where the 'aborted' field of a transaction object is read after the fs_info->trans_lock has been released and without holding a proper reference count. A concurrent task aborting the transaction can free the memory before the read occurs. An attacker with local access could exploit this to trigger a kernel panic or achieve arbitrary code execution. The fix involves moving the 'aborted' field check inside the protection of the trans_lock.
Affected products
- Linux Linux Kernel 6.14-rc1 and earlier
Timeline
- 2025-01-20: patched: Initial patch authored by Filipe Manana
- 2025-02-27: disclosed: CVE-2025-21753 published
References
- https://git.kernel.org/stable/c/6ba4663ada6c6315af23a6669d386146634808ec
- https://git.kernel.org/stable/c/7e954b6bb95d67ae4d1a20e9cfd83c182cf929bc
- https://git.kernel.org/stable/c/86d71a026a7f63da905db9add845c8ee88801eca
- https://git.kernel.org/stable/c/8f5cff471039caa2b088060c074c2bf2081bcb01
- https://git.kernel.org/stable/c/c7a53757717e68af94a56929d57f1e6daff220ec
- https://git.kernel.org/stable/c/ce628048390dad80320d5a1f74de6ca1e1be91e7
- https://git.kernel.org/stable/c/cee55b1219568c80bf0d5dc55066e4a859baf753