CVE-2025-21753
HighSummary
A vulnerability has been identified in the Linux kernel within the btrfs filesystem, which involves a use-after-free error when attempting to join an aborted transaction. The issue arises when reading the 'aborted' field after unlocking trans_lock, potentially leading to unsafe memory access.
Risk Assessment
This vulnerability could lead to unpredictable system behavior, including crashes or data integrity violations, posing a serious threat to system stability and security.
Recommendation
It is recommended to update the Linux kernel to the latest version where this vulnerability has been fixed to minimize risks associated with using the btrfs filesystem.
Other vulnerabilities in Linux kernel, btrfs filesystem
See all- CVE-2026-46251High
A vulnerability related to the corruption of the dirty_list in the block group tree in the btrfs filesystem has been fixed in the Linux kernel. The issue occurs when the EXTENT_TREE_V2 flag is set, leading to improper addition of elements to the list and potentially causing transaction errors.
- CVE-2026-45934Medium
A vulnerability has been identified in the Linux kernel within the Btrfs filesystem that leads to system aborts during chunk allocation due to non-consecutive gaps. This issue can occur with DUP chunk allocations, resulting in an EEXIST error.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free when attempting to join an aborted transaction When we are trying to join the current transaction and if it's aborted, we read its 'aborted' field after unlocking fs_info->trans_lock and without holding any extra reference count on it. This means that a concurrent task that is aborting the transaction may free the transaction before we read its 'aborted' field, leading to a use-after-free. Fix this by reading the 'aborted' field while holding fs_info->trans_lock since any freeing task must first acquire that lock and set fs_info->running_transaction to NULL before freeing the transaction. This was reported by syzbot and Dmitry with the following stack traces from KASAN: ================================================================== BUG: KASAN: slab-use-after-free in join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278 Read of size 4 at addr ffff888011839024 by task kworker