CVE-2025-21879 (GCVE-0-2025-21879)

Vulnerability from cvelistv5 – Published: 2025-03-27 14:57 – Updated: 2026-08-05 11:55
VLAI
Title
btrfs: fix use-after-free on inode when scanning root during em shrinking
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free on inode when scanning root during em shrinking At btrfs_scan_root() we are accessing the inode's root (and fs_info) in a call to btrfs_fs_closing() after we have scheduled the inode for a delayed iput, and that can result in a use-after-free on the inode in case the cleaner kthread does the iput before we dereference the inode in the call to btrfs_fs_closing(). Fix this by using the fs_info stored already in a local variable instead of doing inode->root->fs_info.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: fef55c4d9c9c22264d2b2ceae1e26922cb6129a5 , < 07836bc18f4ae42da4e922244f4685561c18755e (git)
Affected: 1020443840569535f6025a855958f07ea3eebf71 , < 5e79d26014f9386387575b9ed60d342057cee49b (git)
Affected: 1020443840569535f6025a855958f07ea3eebf71 , < 59f37036bb7ab3d554c24abc856aabca01126414 (git)
Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.13.6 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21879",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-28T15:22:49.038837Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-28T15:31:59.926Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/extent_map.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "07836bc18f4ae42da4e922244f4685561c18755e",
              "status": "affected",
              "version": "fef55c4d9c9c22264d2b2ceae1e26922cb6129a5",
              "versionType": "git"
            },
            {
              "lessThan": "5e79d26014f9386387575b9ed60d342057cee49b",
              "status": "affected",
              "version": "1020443840569535f6025a855958f07ea3eebf71",
              "versionType": "git"
            },
            {
              "lessThan": "59f37036bb7ab3d554c24abc856aabca01126414",
              "status": "affected",
              "version": "1020443840569535f6025a855958f07ea3eebf71",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/extent_map.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.6",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free on inode when scanning root during em shrinking\n\nAt btrfs_scan_root() we are accessing the inode\u0027s root (and fs_info) in a\ncall to btrfs_fs_closing() after we have scheduled the inode for a delayed\niput, and that can result in a use-after-free on the inode in case the\ncleaner kthread does the iput before we dereference the inode in the call\nto btrfs_fs_closing().\n\nFix this by using the fs_info stored already in a local variable instead\nof doing inode-\u003eroot-\u003efs_info."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable `btrfs_extent_map_shrinker_worker` is reached only through the superblock shrinker (`btrfs_free_cached_objects()` \u2192 `btrfs_free_extent_maps()`) on a locally mounted btrfs filesystem, so the attacker must be able to generate local file I/O and memory pressure. No remote protocol data is parsed on this path.\nAC:L - The attacker drives both sides of the race \u2014 memory pressure queues the em shrinker work while concurrent unlink/subvolume-delete churn keeps the cleaner kthread active \u2014 and `btrfs_add_delayed_iput()` itself calls `wake_up_process(fs_info-\u003ecleaner_kthread)` immediately before the dangling dereference, so no attacker-uncontrollable timing is needed. Every inode the shrinker scans is a fresh attempt and the workload can be repeated indefinitely.\nPR:L - Any unprivileged local user with write access to a btrfs filesystem (the default root fs on Fedora, openSUSE, SteamOS and many NAS/appliance images, and common for container overlay storage) can populate extent maps and drive reclaim; there is no capability check, LSM gate, or admin-only ioctl anywhere on the path.\nUI:N - The attacker\u0027s own filesystem activity and memory-pressure workload trigger the shrinker worker and the cleaner kthread; no victim needs to mount, open, or otherwise interact with anything.\nS:U - The use-after-free occurs in a kernel workqueue worker against kernel slab memory within the same security authority as the vulnerable kernel; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a CWE-416 use-after-free where the freed `btrfs_inode` slab object is dereferenced as a pointer chain (`inode-\u003eroot-\u003efs_info`); an attacker who grooms `btrfs_inode_cachep` via concurrent inode allocation controls the contents at that offset, turning the dereference into a read at an attacker-influenced kernel address, and UAF windows on a dedicated inode cache are a well-established primitive for kernel memory disclosure.\nI:H - Use-after-free on a live slab object gives the attacker a dangling reference into memory that is concurrently reallocated and written by other inodes, which combined with heap grooming is the standard basis for corrupting adjacent kernel state and hijacking control flow. Scored high per the memory-corruption guidance rather than limited to the immediate observed symptom.\nA:H - Reading `inode-\u003eroot` from the reallocated object commonly yields NULL (set by `btrfs_alloc_inode()`, and guaranteed under `init_on_free=1`) or garbage, producing a kernel oops in the em shrinker worker; with KASAN enabled it is a slab-use-after-free splat that panics under `panic_on_warn`."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:55:04.752Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/07836bc18f4ae42da4e922244f4685561c18755e"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e79d26014f9386387575b9ed60d342057cee49b"
        },
        {
          "url": "https://git.kernel.org/stable/c/59f37036bb7ab3d554c24abc856aabca01126414"
        }
      ],
      "title": "btrfs: fix use-after-free on inode when scanning root during em shrinking",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21879",
    "datePublished": "2025-03-27T14:57:08.929Z",
    "dateReserved": "2024-12-29T08:45:45.782Z",
    "dateUpdated": "2026-08-05T11:55:04.752Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21879",
      "date": "2026-08-11",
      "epss": "0.00196",
      "percentile": "0.09526"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-21879\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-03-27T15:15:55.790\",\"lastModified\":\"2026-06-17T08:44:31.037\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix use-after-free on inode when scanning root during em shrinking\\n\\nAt btrfs_scan_root() we are accessing the inode\u0027s root (and fs_info) in a\\ncall to btrfs_fs_closing() after we have scheduled the inode for a delayed\\niput, and that can result in a use-after-free on the inode in case the\\ncleaner kthread does the iput before we dereference the inode in the call\\nto btrfs_fs_closing().\\n\\nFix this by using the fs_info stored already in a local variable instead\\nof doing inode-\u003eroot-\u003efs_info.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: se corrige el use-after-free en el inodo al escanear la ra\u00edz durante la reducci\u00f3n de em. En btrfs_scan_root(), accedemos a la ra\u00edz del inodo (y a fs_info) en una llamada a btrfs_fs_closing() despu\u00e9s de haber programado el inodo para una entrada retrasada, lo que puede resultar en un use-after-free en el inodo en caso de que el kthread m\u00e1s limpio realice la entrada antes de que desreferenciamos el inodo en la llamada a btrfs_fs_closing(). Se soluciona esto usando la fs_info ya almacenada en una variable local en lugar de hacer inode-\u0026gt;root-\u0026gt;fs_info.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/btrfs/extent_map.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fef55c4d9c9c22264d2b2ceae1e26922cb6129a5\",\"lessThan\":\"07836bc18f4ae42da4e922244f4685561c18755e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1020443840569535f6025a855958f07ea3eebf71\",\"lessThan\":\"5e79d26014f9386387575b9ed60d342057cee49b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1020443840569535f6025a855958f07ea3eebf71\",\"lessThan\":\"59f37036bb7ab3d554c24abc856aabca01126414\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/btrfs/extent_map.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.13.6\",\"lessThanOrEqual\":\"6.13.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.14\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-03-28T15:22:49.038837Z\",\"id\":\"CVE-2025-21879\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.13.6\",\"matchCriteriaId\":\"64F12D9B-71C2-4CD7-A288-0D5EF1709620\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"186716B6-2B66-4BD0-852E-D48E71C0C85F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D3E781C-403A-498F-9DA9-ECEE50F41E75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"66619FB8-0AAF-4166-B2CF-67B24143261D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3D6550E-6679-4560-902D-AF52DCFE905B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/07836bc18f4ae42da4e922244f4685561c18755e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/59f37036bb7ab3d554c24abc856aabca01126414\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5e79d26014f9386387575b9ed60d342057cee49b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-06-29T20:35:16+00:00",
      "cve": "CVE-2025-21879",
      "id": "CVE-2025-21879",
      "initial_release_date": "2025-03-27T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: btrfs: fix use-after-free on inode when scanning root during em shrinking",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21879.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-25T01:03:31Z",
      "cve": "CVE-2025-21879",
      "id": "CVE-2025-21879",
      "initial_release_date": "2025-03-28T03:00:52Z",
      "product_status:known_affected": "57",
      "product_status:known_not_affected": "287",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-21879",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-21879.json",
      "version": "8"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-21879\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-03-28T15:22:49.038837Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-03-28T15:22:50.414Z\"}}], \"cna\": {\"title\": \"btrfs: fix use-after-free on inode when scanning root during em shrinking\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable `btrfs_extent_map_shrinker_worker` is reached only through the superblock shrinker (`btrfs_free_cached_objects()` \\u2192 `btrfs_free_extent_maps()`) on a locally mounted btrfs filesystem, so the attacker must be able to generate local file I/O and memory pressure. No remote protocol data is parsed on this path.\\nAC:L - The attacker drives both sides of the race \\u2014 memory pressure queues the em shrinker work while concurrent unlink/subvolume-delete churn keeps the cleaner kthread active \\u2014 and `btrfs_add_delayed_iput()` itself calls `wake_up_process(fs_info-\u003ecleaner_kthread)` immediately before the dangling dereference, so no attacker-uncontrollable timing is needed. Every inode the shrinker scans is a fresh attempt and the workload can be repeated indefinitely.\\nPR:L - Any unprivileged local user with write access to a btrfs filesystem (the default root fs on Fedora, openSUSE, SteamOS and many NAS/appliance images, and common for container overlay storage) can populate extent maps and drive reclaim; there is no capability check, LSM gate, or admin-only ioctl anywhere on the path.\\nUI:N - The attacker\u0027s own filesystem activity and memory-pressure workload trigger the shrinker worker and the cleaner kthread; no victim needs to mount, open, or otherwise interact with anything.\\nS:U - The use-after-free occurs in a kernel workqueue worker against kernel slab memory within the same security authority as the vulnerable kernel; no VM, IOMMU, or sandbox boundary is crossed.\\nC:H - This is a CWE-416 use-after-free where the freed `btrfs_inode` slab object is dereferenced as a pointer chain (`inode-\u003eroot-\u003efs_info`); an attacker who grooms `btrfs_inode_cachep` via concurrent inode allocation controls the contents at that offset, turning the dereference into a read at an attacker-influenced kernel address, and UAF windows on a dedicated inode cache are a well-established primitive for kernel memory disclosure.\\nI:H - Use-after-free on a live slab object gives the attacker a dangling reference into memory that is concurrently reallocated and written by other inodes, which combined with heap grooming is the standard basis for corrupting adjacent kernel state and hijacking control flow. Scored high per the memory-corruption guidance rather than limited to the immediate observed symptom.\\nA:H - Reading `inode-\u003eroot` from the reallocated object commonly yields NULL (set by `btrfs_alloc_inode()`, and guaranteed under `init_on_free=1`) or garbage, producing a kernel oops in the em shrinker worker; with KASAN enabled it is a slab-use-after-free splat that panics under `panic_on_warn`.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"fef55c4d9c9c22264d2b2ceae1e26922cb6129a5\", \"lessThan\": \"07836bc18f4ae42da4e922244f4685561c18755e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1020443840569535f6025a855958f07ea3eebf71\", \"lessThan\": \"5e79d26014f9386387575b9ed60d342057cee49b\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"1020443840569535f6025a855958f07ea3eebf71\", \"lessThan\": \"59f37036bb7ab3d554c24abc856aabca01126414\", \"versionType\": \"git\"}], \"programFiles\": [\"fs/btrfs/extent_map.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.13\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.13\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.13.6\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.13.*\"}, {\"status\": \"unaffected\", \"version\": \"6.14\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"fs/btrfs/extent_map.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/07836bc18f4ae42da4e922244f4685561c18755e\"}, {\"url\": \"https://git.kernel.org/stable/c/5e79d26014f9386387575b9ed60d342057cee49b\"}, {\"url\": \"https://git.kernel.org/stable/c/59f37036bb7ab3d554c24abc856aabca01126414\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: fix use-after-free on inode when scanning root during em shrinking\\n\\nAt btrfs_scan_root() we are accessing the inode\u0027s root (and fs_info) in a\\ncall to btrfs_fs_closing() after we have scheduled the inode for a delayed\\niput, and that can result in a use-after-free on the inode in case the\\ncleaner kthread does the iput before we dereference the inode in the call\\nto btrfs_fs_closing().\\n\\nFix this by using the fs_info stored already in a local variable instead\\nof doing inode-\u003eroot-\u003efs_info.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.13.6\", \"versionStartIncluding\": \"6.13\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.14\", \"versionStartIncluding\": \"6.13\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T11:55:04.752Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-21879\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T11:55:04.752Z\", \"dateReserved\": \"2024-12-29T08:45:45.782Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-03-27T14:57:08.929Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.