Executive brief
A vulnerability in the Linux kernel's Btrfs file system could allow a local user to cause system instability or data corruption. The issue occurs when the system fails to properly handle certain internal data updates, potentially allowing incorrect information to be saved to the disk. This could lead to a complete system crash or the loss of stored files.
Technical details
A logic error in the Btrfs file system's btrfs_copy_root() function fails to abort transactions when an unexpected generation is detected for an extent buffer being cloned. Previously, the kernel would only issue a warning (WARN_ON) and continue, potentially persisting corrupted or inconsistent metadata to disk. An attacker with local access could exploit this to trigger a transaction abort or cause file system inconsistency. The fix ensures that the transaction is properly aborted and returns an -EUCLEAN error when an invalid generation is encountered. Patches have been backported to various stable kernel branches including 6.1, 6.6, 6.12, and 6.16.
Affected products
- Linux Linux Kernel 2.6.29 to 6.16.4
- Siemens SIMATIC CN 4100 < V5.0
Timeline
- 2025-05-19: other: Initial patch authored
- 2025-09-15: advisory: CVE published
References
- https://git.kernel.org/stable/c/33e8f24b52d2796b8cfb28c19a1a7dd6476323a8
- https://git.kernel.org/stable/c/4290e34fb87ae556b12c216efd0ae91583446b7a
- https://git.kernel.org/stable/c/4734255ef39b416864139dcda96a387fe5f33a6a
- https://git.kernel.org/stable/c/da2124719f386b6e5d4d4b1a2e67c440e4d5892f
- https://git.kernel.org/stable/c/f4f5bd9251a4cbe55aaa05725c6c3c32ad1f74b3
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html
- https://cert-portal.siemens.com/productcert/html/ssa-032379.html