Executive brief
A vulnerability in the Linux kernel's Btrfs file system could lead to a system crash or data corruption when the file system encounters an error. Specifically, when using certain storage configurations like RAID5 or RAID6, the system may attempt to write data to the disk after the necessary background services have already shut down. This can result in a system failure (use-after-free) or further corruption of the stored data.
Technical details
A use-after-free vulnerability exists in the Btrfs file system implementation within the Linux kernel. When a Btrfs file system encounters an error, it enters a frozen state, but dirty metadata folios may remain in the btree inode page cache. During the 'close_ctree()' process, after 'btrfs_stop_all_workers()' has been called, an 'iput()' on the btree inode can trigger a writeback of this dirty metadata. In configurations using RAID56, this triggers a Read-Modify-Write (RMW) cycle that attempts to queue work to already-stopped 'rmw_workers', leading to a use-after-free. The fix involves modifying 'write_one_eb()' to immediately fail bio submissions if the file system is already in an error state, ensuring dirty blocks are discarded rather than written back during shutdown.
Affected products
- Linux Linux Kernel 3.10 to 6.17.8
Timeline
- 2025-10-23: patched: Initial fix authored
- 2025-12-08: disclosed: CVE published