CVE-2025-37856

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-37856", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.956Z", "datePublished": "2025-05-09T06:42:04.315Z", "dateUpdated": "2026-10-30T12:21:24.224Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:21:24.224Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: harden block_group::bg_list against list_del() races\n\nAs far as I can tell, these calls of list_del_init() on bg_list cannot\nrun concurrently with btrfs_mark_bg_unused() or btrfs_mark_bg_to_reclaim(),\nas they are in transaction error paths and situations where the block\ngroup is readonly.\n\nHowever, if there is any chance at all of racing with mark_bg_unused(),\nor a different future user of bg_list, better to be safe than sorry.\n\nOtherwise we risk the following interleaving (bg_list refcount in parens)\n\nT1 (some random op) T2 (btrfs_mark_bg_unused)\n !list_empty(&bg->bg_list); (1)\nlist_del_init(&bg->bg_list); (1)\n list_move_tail (1)\nbtrfs_put_block_group (0)\n btrfs_delete_unused_bgs\n bg = list_first_entry\n list_del_init(&bg->bg_list);\n btrfs_put_block_group(bg); (-1)\n\nUltimately, this results in a broken ref count that hits zero one deref\nearly and the real final deref underflows the refcount, resulting in a WARNING."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is btrfs's core block-group allocator, reached through ordinary file creation/deletion, `sync()`/`fsync()`, and ENOSPC-driven transaction aborts on a locally mounted btrfs filesystem. There is no network protocol handler in the path.\nAC:L - The attacker drives both sides of the race with a single unprivileged workload \u2014 emptying block groups feeds `btrfs_mark_bg_unused()` while `sync()` forces the `btrfs_finish_extent_commit()` traversal \u2014 and the create/delete/sync loop can be repeated indefinitely until the window is hit. The same bg_list refcount race was demonstrably reproduced in practice by its sibling CVE-2025-22115 and by fstests generic/297.\nPR:L - Any unprivileged local user with write access to a btrfs mount (home directory, `/tmp`, or a container volume) can trigger the full sequence; no capability, no user namespace, and no CAP_SYS_ADMIN operation such as scrub or balance is required.\nUI:N - The attacker's own process performs every step, and the cleaner kthread consumes the freed object on its own timer. btrfs is the default root filesystem on Fedora and openSUSE, so no victim needs to mount anything.\nS:U - The refcount underflow, the freed object, and its consumer all live in the kernel's own security authority, with no crossing of a hypervisor, IOMMU, or sandbox boundary.\nC:H - `btrfs_put_block_group()` `kfree()`s the block group into a general kmalloc cache while it is still linked on `fs_info->unused_bgs`, so an unprivileged heap spray can reclaim the slot and the cleaner kthread will read `space_info`, `start`, `length`, and `flags` back out of it, exposing kernel heap contents.\nI:H - `list_del_init()` on the freed node writes through attacker-reclaimed `prev`/`next` pointers, yielding a controlled kernel write primitive, and the downstream `btrfs_remove_chunk(trans, block_group->start)` operates on a garbage offset, destroying live on-disk btrfs metadata.\nA:H - The refcount underflow raises `refcount_t: underflow; use-after-free`, an immediate panic under the widely deployed `panic_on_warn=1`, and the use-after-free crashes the cleaner kthread and can corrupt or wedge the filesystem outright."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/btrfs/extent-tree.c", "fs/btrfs/transaction.c"], "versions": [{"version": "01eca70ef8cf499d0cb6d1bbd691558e7792cf17", "lessThan": "ccb20413e7c82e4429c81f10d0e36cd9c0c643cd", "status": "affected", "versionType": "git"}, {"version": "a9f189716cf15913c453299d72f69c51a9b0f86b", "lessThan": "9039afe6240ae01d6caf2fa731590ac74fb8a69b", "status": "affected", "versionType": "git"}, {"version": "a9f189716cf15913c453299d72f69c51a9b0f86b", "lessThan": "bf089c4d1141b27332c092b1dcca5022c415a3b6", "status": "affected", "versionType": "git"}, {"version": "a9f189716cf15913c453299d72f69c51a9b0f86b", "lessThan": "909e60fb469d4101c6b08cf6e622efb062bb24a1", "status": "affected", "versionType": "git"}, {"version": "a9f189716cf15913c453299d72f69c51a9b0f86b", "lessThan": "185fd73e5ac06027c4be9a129e59193f6a3ef202", "status": "affected", "versionType": "git"}, {"version": "a9f189716cf15913c453299d72f69c51a9b0f86b", "lessThan": "7511e29cf1355b2c47d0effb39e463119913e2f6", "status": "affected", "versionType": "git"}, {"version": "edf3b5aadb2515c808200b904baa5b70a727f0ac", "status": "affected", "versionType": "git"}, {"version": "5d19abcffd8404078dfa7d7118cec357b5e7bc58", "status": "affected", "versionType": "git"}, {"version": "6.1.47", "lessThan": "6.1.191", "status": "affected", "versionType": "semver"}, {"version": "5.15.128", "lessThan": "5.16", "status": "affected", "versionType": "semver"}, {"version": "6.4.12", "lessThan": "6.5", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/btrfs/extent-tree.c", "fs/btrfs/transaction.c"], "versions": [{"version": "6.5", "status": "affected"}, {"version": "0", "lessThan": "6.5", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.24", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.12", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14.3", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.47", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.12.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.13.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.14.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5", "versionEndExcluding": "6.15"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.128"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4.12"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ccb20413e7c82e4429c81f10d0e36cd9c0c643cd"}, {"url": "https://git.kernel.org/stable/c/9039afe6240ae01d6caf2fa731590ac74fb8a69b"}, {"url": "https://git.kernel.org/stable/c/bf089c4d1141b27332c092b1dcca5022c415a3b6"}, {"url": "https://git.kernel.org/stable/c/909e60fb469d4101c6b08cf6e622efb062bb24a1"}, {"url": "https://git.kernel.org/stable/c/185fd73e5ac06027c4be9a129e59193f6a3ef202"}, {"url": "https://git.kernel.org/stable/c/7511e29cf1355b2c47d0effb39e463119913e2f6"}], "title": "btrfs: harden block_group::bg_list against list_del() races", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/btrfs/extent-tree.c", "fs/btrfs/transaction.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ccb20413e7c82e4429c81f10d0e36cd9c0c643cd", "status": "affected", "version": "01eca70ef8cf499d0cb6d1bbd691558e7792cf17", "versionType": "git"}, {"lessThan": "9039afe6240ae01d6caf2fa731590ac74fb8a69b", "status": "affected", "version": "a9f189716cf15913c453299d72f69c51a9b0f86b", "versionType": "git"}, {"lessThan": "bf089c4d1141b27332c092b1dcca5022c415a3b6", "status": "affected", "version": "a9f189716cf15913c453299d72f69c51a9b0f86b", "versionType": "git"}, {"lessThan": "909e60fb469d4101c6b08cf6e622efb062bb24a1", "status": "affected", "version": "a9f189716cf15913c453299d72f69c51a9b0f86b", "versionType": "git"}, {"lessThan": "185fd73e5ac06027c4be9a129e59193f6a3ef202", "status": "affected", "version": "a9f189716cf15913c453299d72f69c51a9b0f86b", "versionType": "git"}, {"lessThan": "7511e29cf1355b2c47d0effb39e463119913e2f6", "status": "affected", "version": "a9f189716cf15913c453299d72f69c51a9b0f86b", "versionType": "git"}, {"status": "affected", "version": "edf3b5aadb2515c808200b904baa5b70a727f0ac", "versionType": "git"}, {"status": "affected", "version": "5d19abcffd8404078dfa7d7118cec357b5e7bc58", "versionType": "git"}, {"lessThan": "6.1.191", "status": "affected", "version": "6.1.47", "versionType": "semver"}, {"lessThan": "5.16", "status": "affected", "version": "5.15.128", "versionType": "semver"}, {"lessThan": "6.5", "status": "affected", "version": "6.4.12", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/btrfs/extent-tree.c", "fs/btrfs/transaction.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.5"}, {"lessThan": "6.5", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.24", "versionType": "semver"}, {"lessThanOrEqual": "6.13.*", "status": "unaffected", "version": "6.13.12", "versionType": "semver"}, {"lessThanOrEqual": "6.14.*", "status": "unaffected", "version": "6.14.3", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.15", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C87CF81F-5426-4E15-8A61-B8F0E6046484", "versionEndExcluding": "6.12.24", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4A475784-BF3B-4514-81EE-49C8522FB24A", "versionEndExcluding": "6.13.12", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "483E2E15-2135-4EC6-AB64-16282C5EF704", "versionEndExcluding": "6.14.3", "versionStartIncluding": "6.14", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: harden block_group::bg_list against list_del() races\n\nAs far as I can tell, these calls of list_del_init() on bg_list cannot\nrun concurrently with btrfs_mark_bg_unused() or btrfs_mark_bg_to_reclaim(),\nas they are in transaction error paths and situations where the block\ngroup is readonly.\n\nHowever, if there is any chance at all of racing with mark_bg_unused(),\nor a different future user of bg_list, better to be safe than sorry.\n\nOtherwise we risk the following interleaving (bg_list refcount in parens)\n\nT1 (some random op) T2 (btrfs_mark_bg_unused)\n !list_empty(&bg->bg_list); (1)\nlist_del_init(&bg->bg_list); (1)\n list_move_tail (1)\nbtrfs_put_block_group (0)\n btrfs_delete_unused_bgs\n bg = list_first_entry\n list_del_init(&bg->bg_list);\n btrfs_put_block_group(bg); (-1)\n\nUltimately, this results in a broken ref count that hits zero one deref\nearly and the real final deref underflows the refcount, resulting in a WARNING."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: endurecer block_group::bg_list contra ejecuciones list_del() Hasta donde puedo decir, estas llamadas de list_del_init() en bg_list no se pueden ejecutar simult\u00e1neamente con btrfs_mark_bg_unused() o btrfs_mark_bg_to_reclaim(), ya que est\u00e1n en rutas de error de transacci\u00f3n y situaciones en las que el grupo de bloques es de solo lectura. Sin embargo, si hay alguna posibilidad de competir con mark_bg_unused(), o con un futuro usuario diferente de bg_list, m\u00e1s vale prevenir que curar. De lo contrario, nos arriesgamos al siguiente intercalado (bg_list refcount entre par\u00e9ntesis) T1 (alguna operaci\u00f3n aleatoria) T2 (btrfs_mark_bg_unused) !list_empty(&bg->bg_list); (1) list_del_init(&bg->bg_list); (1) list_move_tail (1) btrfs_put_block_group (0) btrfs_delete_unused_bgs bg = list_first_entry list_del_init(&bg->bg_list); btrfs_put_block_group(bg); (-1) En \u00faltima instancia, esto da como resultado un recuento de referencias roto que llega a cero un deref antes y el deref final real desborda el recuento de referencias, lo que genera una ADVERTENCIA."}], "id": "CVE-2025-37856", "lastModified": "2026-10-30T13:17:58.327", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-05-09T07:16:06.593", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/185fd73e5ac06027c4be9a129e59193f6a3ef202"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7511e29cf1355b2c47d0effb39e463119913e2f6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9039afe6240ae01d6caf2fa731590ac74fb8a69b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/909e60fb469d4101c6b08cf6e622efb062bb24a1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bf089c4d1141b27332c092b1dcca5022c415a3b6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ccb20413e7c82e4429c81f10d0e36cd9c0c643cd"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: btrfs: harden block_group::bg_list against list_del() races", "id": "2365242", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2365242"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbtrfs: harden block_group::bg_list against list_del() races\nAs far as I can tell, these calls of list_del_init() on bg_list cannot\nrun concurrently with btrfs_mark_bg_unused() or btrfs_mark_bg_to_reclaim(),\nas they are in transaction error paths and situations where the block\ngroup is readonly.\nHowever, if there is any chance at all of racing with mark_bg_unused(),\nor a different future user of bg_list, better to be safe than sorry.\nOtherwise we risk the following interleaving (bg_list refcount in parens)\nT1 (some random op) T2 (btrfs_mark_bg_unused)\n!list_empty(&bg->bg_list); (1)\nlist_del_init(&bg->bg_list); (1)\nlist_move_tail (1)\nbtrfs_put_block_group (0)\nbtrfs_delete_unused_bgs\nbg = list_first_entry\nlist_del_init(&bg->bg_list);\nbtrfs_put_block_group(bg); (-1)\nUltimately, this results in a broken ref count that hits zero one deref\nearly and the real final deref underflows the refcount, resulting in a WARNING."], "name": "CVE-2025-37856", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-05-09T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-37856\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-37856\nhttps://lore.kernel.org/linux-cve-announce/2025050921-CVE-2025-37856-3117@gregkh/T"], "threat_severity": "Moderate"}

{}