GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-21658 (GCVE-0-2025-21658)

Vulnerability from cvelistv5 – Published: 2025-01-21 12:18 – Updated: 2026-05-11 21:03
VLAI
Title
btrfs: avoid NULL pointer dereference if no valid extent tree
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid NULL pointer dereference if no valid extent tree [BUG] Syzbot reported a crash with the following call trace: BTRFS info (device loop0): scrub: started on devid 1 BUG: kernel NULL pointer dereference, address: 0000000000000208 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 106e70067 P4D 106e70067 PUD 107143067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 UID: 0 PID: 689 Comm: repro Kdump: loaded Tainted: G O 6.13.0-rc4-custom+ #206 Tainted: [O]=OOT_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:find_first_extent_item+0x26/0x1f0 [btrfs] Call Trace: <TASK> scrub_find_fill_first_stripe+0x13d/0x3b0 [btrfs] scrub_simple_mirror+0x175/0x260 [btrfs] scrub_stripe+0x5d4/0x6c0 [btrfs] scrub_chunk+0xbb/0x170 [btrfs] scrub_enumerate_chunks+0x2f4/0x5f0 [btrfs] btrfs_scrub_dev+0x240/0x600 [btrfs] btrfs_ioctl+0x1dc8/0x2fa0 [btrfs] ? do_sys_openat2+0xa5/0xf0 __x64_sys_ioctl+0x97/0xc0 do_syscall_64+0x4f/0x120 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> [CAUSE] The reproducer is using a corrupted image where extent tree root is corrupted, thus forcing to use "rescue=all,ro" mount option to mount the image. Then it triggered a scrub, but since scrub relies on extent tree to find where the data/metadata extents are, scrub_find_fill_first_stripe() relies on an non-empty extent root. But unfortunately scrub_find_fill_first_stripe() doesn't really expect an NULL pointer for extent root, it use extent_root to grab fs_info and triggered a NULL pointer dereference. [FIX] Add an extra check for a valid extent root at the beginning of scrub_find_fill_first_stripe(). The new error path is introduced by 42437a6386ff ("btrfs: introduce mount option rescue=ignorebadroots"), but that's pretty old, and later commit b979547513ff ("btrfs: scrub: introduce helper to find and fill sector info for a scrub_stripe") changed how we do scrub. So for kernels older than 6.6, the fix will need manual backport.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:52 UTC
CWE
  • CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 42437a6386ffeaaf200731e73d723ea491f3fe7d , < 24b85a8b0310e0144da9ab30be42e87e6476638a (git)
Affected: 42437a6386ffeaaf200731e73d723ea491f3fe7d , < aee5f69f3e6cd82bfefaca1b70b40b6cd8f3f784 (git)
Affected: 42437a6386ffeaaf200731e73d723ea491f3fe7d , < 6aecd91a5c5b68939cf4169e32bc49f3cd2dd329 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.11
Unaffected: 0 , < 5.11 (semver)
Unaffected: 6.6.72 , ≤ 6.6.* (semver)
Unaffected: 6.12.10 , ≤ 6.12.* (semver)
Unaffected: 6.13 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21658",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:52:37.080379Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:57:13.496Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/scrub.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "24b85a8b0310e0144da9ab30be42e87e6476638a",
              "status": "affected",
              "version": "42437a6386ffeaaf200731e73d723ea491f3fe7d",
              "versionType": "git"
            },
            {
              "lessThan": "aee5f69f3e6cd82bfefaca1b70b40b6cd8f3f784",
              "status": "affected",
              "version": "42437a6386ffeaaf200731e73d723ea491f3fe7d",
              "versionType": "git"
            },
            {
              "lessThan": "6aecd91a5c5b68939cf4169e32bc49f3cd2dd329",
              "status": "affected",
              "version": "42437a6386ffeaaf200731e73d723ea491f3fe7d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/scrub.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.11"
            },
            {
              "lessThan": "5.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.72",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.72",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.10",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "5.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: avoid NULL pointer dereference if no valid extent tree\n\n[BUG]\nSyzbot reported a crash with the following call trace:\n\n  BTRFS info (device loop0): scrub: started on devid 1\n  BUG: kernel NULL pointer dereference, address: 0000000000000208\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 106e70067 P4D 106e70067 PUD 107143067 PMD 0\n  Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI\n  CPU: 1 UID: 0 PID: 689 Comm: repro Kdump: loaded Tainted: G           O       6.13.0-rc4-custom+ #206\n  Tainted: [O]=OOT_MODULE\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022\n  RIP: 0010:find_first_extent_item+0x26/0x1f0 [btrfs]\n  Call Trace:\n   \u003cTASK\u003e\n   scrub_find_fill_first_stripe+0x13d/0x3b0 [btrfs]\n   scrub_simple_mirror+0x175/0x260 [btrfs]\n   scrub_stripe+0x5d4/0x6c0 [btrfs]\n   scrub_chunk+0xbb/0x170 [btrfs]\n   scrub_enumerate_chunks+0x2f4/0x5f0 [btrfs]\n   btrfs_scrub_dev+0x240/0x600 [btrfs]\n   btrfs_ioctl+0x1dc8/0x2fa0 [btrfs]\n   ? do_sys_openat2+0xa5/0xf0\n   __x64_sys_ioctl+0x97/0xc0\n   do_syscall_64+0x4f/0x120\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   \u003c/TASK\u003e\n\n[CAUSE]\nThe reproducer is using a corrupted image where extent tree root is\ncorrupted, thus forcing to use \"rescue=all,ro\" mount option to mount the\nimage.\n\nThen it triggered a scrub, but since scrub relies on extent tree to find\nwhere the data/metadata extents are, scrub_find_fill_first_stripe()\nrelies on an non-empty extent root.\n\nBut unfortunately scrub_find_fill_first_stripe() doesn\u0027t really expect\nan NULL pointer for extent root, it use extent_root to grab fs_info and\ntriggered a NULL pointer dereference.\n\n[FIX]\nAdd an extra check for a valid extent root at the beginning of\nscrub_find_fill_first_stripe().\n\nThe new error path is introduced by 42437a6386ff (\"btrfs: introduce\nmount option rescue=ignorebadroots\"), but that\u0027s pretty old, and later\ncommit b979547513ff (\"btrfs: scrub: introduce helper to find and fill\nsector info for a scrub_stripe\") changed how we do scrub.\n\nSo for kernels older than 6.6, the fix will need manual backport."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:03:56.225Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/24b85a8b0310e0144da9ab30be42e87e6476638a"
        },
        {
          "url": "https://git.kernel.org/stable/c/aee5f69f3e6cd82bfefaca1b70b40b6cd8f3f784"
        },
        {
          "url": "https://git.kernel.org/stable/c/6aecd91a5c5b68939cf4169e32bc49f3cd2dd329"
        }
      ],
      "title": "btrfs: avoid NULL pointer dereference if no valid extent tree",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21658",
    "datePublished": "2025-01-21T12:18:14.578Z",
    "dateReserved": "2024-12-29T08:45:45.731Z",
    "dateUpdated": "2026-05-11T21:03:56.225Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21658",
      "date": "2026-09-15",
      "epss": "0.00203",
      "percentile": "0.10392"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-31T15:17:47.000Z",
      "cve": "CVE-2025-21658",
      "id": "msrc_CVE-2025-21658",
      "initial_release_date": "2025-01-02T00:00:00.000Z",
      "product_status:fixed": "2",
      "product_status:known_affected": "2",
      "product_status:under_investigation": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "btrfs: avoid NULL pointer dereference if no valid extent tree",
      "url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2025-21658.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21658\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-01-21T13:15:09.437\",\"lastModified\":\"2026-06-17T08:43:57.093\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: avoid NULL pointer dereference if no valid extent tree\\n\\n[BUG]\\nSyzbot reported a crash with the following call trace:\\n\\n  BTRFS info (device loop0): scrub: started on devid 1\\n  BUG: kernel NULL pointer dereference, address: 0000000000000208\\n  #PF: supervisor read access in kernel mode\\n  #PF: error_code(0x0000) - not-present page\\n  PGD 106e70067 P4D 106e70067 PUD 107143067 PMD 0\\n  Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI\\n  CPU: 1 UID: 0 PID: 689 Comm: repro Kdump: loaded Tainted: G           O       6.13.0-rc4-custom+ #206\\n  Tainted: [O]=OOT_MODULE\\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022\\n  RIP: 0010:find_first_extent_item+0x26/0x1f0 [btrfs]\\n  Call Trace:\\n   \u003cTASK\u003e\\n   scrub_find_fill_first_stripe+0x13d/0x3b0 [btrfs]\\n   scrub_simple_mirror+0x175/0x260 [btrfs]\\n   scrub_stripe+0x5d4/0x6c0 [btrfs]\\n   scrub_chunk+0xbb/0x170 [btrfs]\\n   scrub_enumerate_chunks+0x2f4/0x5f0 [btrfs]\\n   btrfs_scrub_dev+0x240/0x600 [btrfs]\\n   btrfs_ioctl+0x1dc8/0x2fa0 [btrfs]\\n   ? do_sys_openat2+0xa5/0xf0\\n   __x64_sys_ioctl+0x97/0xc0\\n   do_syscall_64+0x4f/0x120\\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n   \u003c/TASK\u003e\\n\\n[CAUSE]\\nThe reproducer is using a corrupted image where extent tree root is\\ncorrupted, thus forcing to use \\\"rescue=all,ro\\\" mount option to mount the\\nimage.\\n\\nThen it triggered a scrub, but since scrub relies on extent tree to find\\nwhere the data/metadata extents are, scrub_find_fill_first_stripe()\\nrelies on an non-empty extent root.\\n\\nBut unfortunately scrub_find_fill_first_stripe() doesn\u0027t really expect\\nan NULL pointer for extent root, it use extent_root to grab fs_info and\\ntriggered a NULL pointer dereference.\\n\\n[FIX]\\nAdd an extra check for a valid extent root at the beginning of\\nscrub_find_fill_first_stripe().\\n\\nThe new error path is introduced by 42437a6386ff (\\\"btrfs: introduce\\nmount option rescue=ignorebadroots\\\"), but that\u0027s pretty old, and later\\ncommit b979547513ff (\\\"btrfs: scrub: introduce helper to find and fill\\nsector info for a scrub_stripe\\\") changed how we do scrub.\\n\\nSo for kernels older than 6.6, the fix will need manual backport.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: evitar la desreferencia de puntero NULL si no hay un \u00e1rbol de extensi\u00f3n v\u00e1lido [ERROR] Syzbot inform\u00f3 de un fallo con el siguiente seguimiento de llamada: Informaci\u00f3n de BTRFS (bucle de dispositivo 0): scrub: iniciado en devid 1 ERROR: desreferencia de puntero NULL del kernel, direcci\u00f3n: 0000000000000208 #PF: acceso de lectura de supervisor en modo kernel #PF: error_code(0x0000) - p\u00e1gina no presente PGD 106e70067 P4D 106e70067 PUD 107143067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 UID: 0 PID: 689 Comm: repro Kdump: cargado Tainted: G O 6.13.0-rc4-custom+ #206 Tainted: [O]=OOT_MODULE Nombre de hardware: PC est\u00e1ndar QEMU (Q35 + ICH9, 2009), BIOS desconocido 02/02/2022 RIP: 0010:find_first_extent_item+0x26/0x1f0 [btrfs] Seguimiento de llamadas:  Scrub_find_fill_first_stripe+0x13d/0x3b0 [btrfs] Scrub_simple_mirror+0x175/0x260 [btrfs] Scrub_stripe+0x5d4/0x6c0 [btrfs] Scrub_chunk+0xbb/0x170 [btrfs] Scrub_enumerate_chunks+0x2f4/0x5f0 [btrfs] btrfs_scrub_dev+0x240/0x600 [btrfs] btrfs_ioctl+0x1dc8/0x2fa0 [btrfs] ? do_sys_openat2+0xa5/0xf0 __x64_sys_ioctl+0x97/0xc0 do_syscall_64+0x4f/0x120 entry_SYSCALL_64_after_hwframe+0x76/0x7e  [CAUSA] El reproductor est\u00e1 usando una imagen da\u00f1ada donde la ra\u00edz del \u00e1rbol de extensi\u00f3n est\u00e1 da\u00f1ada, lo que obliga a usar la opci\u00f3n de montaje \\\"rescue=all,ro\\\" para montar la imagen. Luego, activ\u00f3 una limpieza, pero como la limpieza depende del \u00e1rbol de extensi\u00f3n para encontrar d\u00f3nde est\u00e1n las extensiones de datos/metadatos, scrub_find_fill_first_stripe() depende de una ra\u00edz de extensi\u00f3n no vac\u00eda. Pero desafortunadamente scrub_find_fill_first_stripe() no espera realmente un puntero NULL para la ra\u00edz de la extensi\u00f3n, usa extended_root para obtener fs_info y activa una desreferencia de puntero NULL. [SOLUCI\u00d3N] Agregue una verificaci\u00f3n adicional para una ra\u00edz de extensi\u00f3n v\u00e1lida al comienzo de scrub_find_fill_first_stripe(). La nueva ruta de error es introducida por 42437a6386ff (\\\"btrfs: introduce mount option rescue=ignorebadroots\\\"), pero eso es bastante antiguo, y el commit posterior b979547513ff (\\\"btrfs: scrub: introduce helper to find and fill sector info for a scrub_stripe\\\") cambi\u00f3 la forma en que realizamos el scrub. Entonces, para los kernels anteriores a 6.6, la soluci\u00f3n necesitar\u00e1 una adaptaci\u00f3n manual. \"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/btrfs/scrub.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"42437a6386ffeaaf200731e73d723ea491f3fe7d\",\"lessThan\":\"24b85a8b0310e0144da9ab30be42e87e6476638a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"42437a6386ffeaaf200731e73d723ea491f3fe7d\",\"lessThan\":\"aee5f69f3e6cd82bfefaca1b70b40b6cd8f3f784\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"42437a6386ffeaaf200731e73d723ea491f3fe7d\",\"lessThan\":\"6aecd91a5c5b68939cf4169e32bc49f3cd2dd329\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/btrfs/scrub.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.72\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.10\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:52:37.080379Z\",\"id\":\"CVE-2025-21658\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"6.6.72\",\"matchCriteriaId\":\"AD41C3D4-D314-4BC5-888E-E1B87323349D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.10\",\"matchCriteriaId\":\"02D604F6-10D1-4F7B-A022-0888406A1121\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"62567B3C-6CEE-46D0-BC2E-B3717FBF7D13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5A073481-106D-4B15-B4C7-FB0213B8E1D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DE491969-75AE-4A6B-9A58-8FC5AF98798F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"93C0660D-7FB8-4FBA-892A-B064BA71E49E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"034C36A6-C481-41F3-AE9A-D116E5BE6895\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.13:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"8AF9DC49-2085-4FFB-A7E3-73DFAFECC7F2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/24b85a8b0310e0144da9ab30be42e87e6476638a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6aecd91a5c5b68939cf4169e32bc49f3cd2dd329\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/aee5f69f3e6cd82bfefaca1b70b40b6cd8f3f784\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2025-11-21T13:54:19+00:00",
      "cve": "CVE-2025-21658",
      "id": "CVE-2025-21658",
      "initial_release_date": "2025-01-21T00:00:00+00:00",
      "product_status:known_affected": "42",
      "product_status:known_not_affected": "234",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: btrfs: avoid NULL pointer dereference if no valid extent tree",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21658.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-12T16:53:21Z",
      "cve": "CVE-2025-21658",
      "id": "CVE-2025-21658",
      "initial_release_date": "2025-01-22T03:48:24Z",
      "product_status:known_affected": "414",
      "product_status:known_not_affected": "266",
      "product_status:recommended": "592",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21658",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21658.json",
      "version": "61"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21658\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:52:37.080379Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T15:58:02.174Z\"}}], \"cna\": {\"title\": \"btrfs: avoid NULL pointer dereference if no valid extent tree\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"42437a6386ffeaaf200731e73d723ea491f3fe7d\", \"lessThan\": \"24b85a8b0310e0144da9ab30be42e87e6476638a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"42437a6386ffeaaf200731e73d723ea491f3fe7d\", \"lessThan\": \"aee5f69f3e6cd82bfefaca1b70b40b6cd8f3f784\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"42437a6386ffeaaf200731e73d723ea491f3fe7d\", \"lessThan\": \"6aecd91a5c5b68939cf4169e32bc49f3cd2dd329\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/btrfs/scrub.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.11\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.11\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.72\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.13\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/btrfs/scrub.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/24b85a8b0310e0144da9ab30be42e87e6476638a\"}, {\"url\": \"https://git.kernel.org/stable/c/aee5f69f3e6cd82bfefaca1b70b40b6cd8f3f784\"}, {\"url\": \"https://git.kernel.org/stable/c/6aecd91a5c5b68939cf4169e32bc49f3cd2dd329\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: avoid NULL pointer dereference if no valid extent tree\\n\\n[BUG]\\nSyzbot reported a crash with the following call trace:\\n\\n  BTRFS info (device loop0): scrub: started on devid 1\\n  BUG: kernel NULL pointer dereference, address: 0000000000000208\\n  #PF: supervisor read access in kernel mode\\n  #PF: error_code(0x0000) - not-present page\\n  PGD 106e70067 P4D 106e70067 PUD 107143067 PMD 0\\n  Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI\\n  CPU: 1 UID: 0 PID: 689 Comm: repro Kdump: loaded Tainted: G           O       6.13.0-rc4-custom+ #206\\n  Tainted: [O]=OOT_MODULE\\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022\\n  RIP: 0010:find_first_extent_item+0x26/0x1f0 [btrfs]\\n  Call Trace:\\n   \u003cTASK\u003e\\n   scrub_find_fill_first_stripe+0x13d/0x3b0 [btrfs]\\n   scrub_simple_mirror+0x175/0x260 [btrfs]\\n   scrub_stripe+0x5d4/0x6c0 [btrfs]\\n   scrub_chunk+0xbb/0x170 [btrfs]\\n   scrub_enumerate_chunks+0x2f4/0x5f0 [btrfs]\\n   btrfs_scrub_dev+0x240/0x600 [btrfs]\\n   btrfs_ioctl+0x1dc8/0x2fa0 [btrfs]\\n   ? do_sys_openat2+0xa5/0xf0\\n   __x64_sys_ioctl+0x97/0xc0\\n   do_syscall_64+0x4f/0x120\\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\\n   \u003c/TASK\u003e\\n\\n[CAUSE]\\nThe reproducer is using a corrupted image where extent tree root is\\ncorrupted, thus forcing to use \\\"rescue=all,ro\\\" mount option to mount the\\nimage.\\n\\nThen it triggered a scrub, but since scrub relies on extent tree to find\\nwhere the data/metadata extents are, scrub_find_fill_first_stripe()\\nrelies on an non-empty extent root.\\n\\nBut unfortunately scrub_find_fill_first_stripe() doesn\u0027t really expect\\nan NULL pointer for extent root, it use extent_root to grab fs_info and\\ntriggered a NULL pointer dereference.\\n\\n[FIX]\\nAdd an extra check for a valid extent root at the beginning of\\nscrub_find_fill_first_stripe().\\n\\nThe new error path is introduced by 42437a6386ff (\\\"btrfs: introduce\\nmount option rescue=ignorebadroots\\\"), but that\u0027s pretty old, and later\\ncommit b979547513ff (\\\"btrfs: scrub: introduce helper to find and fill\\nsector info for a scrub_stripe\\\") changed how we do scrub.\\n\\nSo for kernels older than 6.6, the fix will need manual backport.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.72\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.10\", \"versionStartIncluding\": \"5.11\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13\", \"versionStartIncluding\": \"5.11\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T07:18:24.189Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21658\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-10-01T19:57:13.496Z\", \"dateReserved\": \"2024-12-29T08:45:45.731Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-01-21T12:18:14.578Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.