Executive brief
A vulnerability was identified in the Linux kernel's Btrfs file system component that could lead to a system crash or instability. The issue occurs when the system attempts to free the same memory twice during specific file system operations involving quota groups. This could potentially be exploited to disrupt operations or gain unauthorized access, though it primarily impacts system reliability.
Technical details
A double-free vulnerability exists in the Btrfs file system's delayed reference handling. The root cause is ambiguous ownership of the 'qrecord' object between the caller and the 'add_delayed_ref_head' function. If 'btrfs_qgroup_trace_extent_nolock' reports an existing record but a subsequent error occurs within 'add_delayed_ref_head', both the callee and the caller may attempt to free the same memory address. The fix involves shifting 'qrecord' ownership entirely to the caller and ensuring proper initialization of the insertion tracking boolean. This vulnerability is reachable via standard file system operations when qgroups are enabled.
Affected products
- Linux Linux Kernel 6.12, 6.17.13, 6.18.2
Timeline
- 2025-12-24: disclosed
- 2025-12-24: advisory