Executive brief
A vulnerability in the Linux kernel's Btrfs file system can lead to data corruption or system instability. On certain hardware configurations, the system may fail to save modified data to the disk correctly. This could result in the loss of important information or a corrupted file system that requires manual repair.
Technical details
A logic error exists in the Btrfs subpage metadata writeback path within 'fs/btrfs/extent_io.c'. When scanning the subpage bitmap for dirty ranges on systems with large page sizes (e.g., 64k) and smaller node sizes (e.g., 16k), the kernel incorrectly increments the bitmap pointer by a single bit ('bit_start++') instead of the full node size when a range is clean. This misalignment causes subsequent dirty blocks to be calculated with incorrect offsets, leading to failed radix tree lookups and skipped writeouts of dirty extent buffers. The vulnerability results in tree log corruption and affects all metadata writes under impacted configurations. Patches have been released for various stable kernel branches including 6.1.y, 6.6.y, 6.12.y, and 6.14.y.
Affected products
- Linux Linux Kernel 5.13 to 6.1.151, 6.2 to 6.6.105, 6.7 to 6.12.28, 6.13 to 6.14.6
Timeline
- 2025-04-14: other: Patch authored by Josef Bacik
- 2025-05-20: disclosed: CVE published
References
- https://git.kernel.org/stable/c/396f4002710030ea1cfd4c789ebaf0a6969ab34f
- https://git.kernel.org/stable/c/5111b148360f50cac9abbae8fca44cc0ac4bf9bf
- https://git.kernel.org/stable/c/977849e8acd2466ac3cb49e04a3ecc73837f6b90
- https://git.kernel.org/stable/c/b80db09b614cb7edec5bada1bc7c7b0eb3b453ea
- https://git.kernel.org/stable/c/e08e49d986f82c30f42ad0ed43ebbede1e1e3739
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html