Executive brief
A vulnerability was identified in the Linux kernel's Btrfs file system component. The issue involves a race condition that could lead to a system crash or unauthorized memory access when the system handles file metadata. This could potentially allow a local user to disrupt system operations or gain elevated privileges.
Technical details
A use-after-free (UAF) vulnerability exists in the Btrfs file system within the Linux kernel. The root cause is a missing memory barrier in btrfs_get_or_create_delayed_node() following changes in commit e8513c012de7. Because refcount_set was moved inside a critical section, stores to the node reference count and the inode's delayed_node pointer could be reordered by the CPU. A concurrent thread could observe the initialized pointer before the reference count is set, leading to an invalid increment and subsequent UAF. This is a local attack vector requiring no special privileges. Patches have been released in stable versions 6.18.6 and the 6.19 development branch.
Affected products
- Linux Linux Kernel 6.18 through 6.18.5, 6.19-rc1 through 6.19-rc4
Timeline
- 2025-12-16: patched: Fix committed to main stable tree
- 2026-01-23: disclosed: CVE published