Executive brief
A vulnerability in the Linux kernel's Btrfs file system could allow a local user to cause a system crash or data integrity issues. The problem occurs when the system attempts to reorganize (relocate) data in subvolumes that were previously partially deleted but not fully cleaned up. This can lead to a transaction abort, resulting in a denial of service or potential file system errors.
Technical details
A vulnerability in the Btrfs file system's relocation logic occurs when a subvolume is in a partially dropped state (non-zero drop_progress) but lacks a corresponding orphan item. This state, often caused by older kernel bugs, leads to a transaction abort (-117) during 'btrfs_run_delayed_refs' because the system attempts to insert extent items that no longer have valid backreferences in the extent tree. The fix introduces a check in 'create_reloc_root' to reject relocation for any subvolume with a non-zero drop_progress key, returning -EUCLEAN instead of allowing a transaction abort. This prevents local users from triggering a kernel warning and file system shutdown via standard balance operations on affected volumes.
Affected products
- Linux Linux Kernel 5.15+
- Siemens SIMATIC CN 4100 before V5.0
Timeline
- 2025-07-25: patched: Initial patch by Qu Wenruo
- 2025-09-11: disclosed: CVE published
References
- https://git.kernel.org/stable/c/125e94a4b76b7b75d194f85bedd628097d2121f0
- https://git.kernel.org/stable/c/39a93e1c9dbf7e11632efeb20fcf0fc1dcf64d51
- https://git.kernel.org/stable/c/4289b494ac553e74e86fed1c66b2bf9530bc1082
- https://git.kernel.org/stable/c/4e403bd8e127d40dc7c05f06ee969c1ba1537ec5
- https://git.kernel.org/stable/c/f83d4c81bda3b7d1813268ab77408f7a0ce691ff
- https://git.kernel.org/stable/c/fa086b1398cf7e5f7dee7241bd5f2855cb5df8dc
- https://git.kernel.org/stable/c/fcb1f77b8ed8795608ca7a1f6505e2b07236c1f3