CVE-2025-21879

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-21879", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-12-29T08:45:45.782Z", "datePublished": "2025-03-27T14:57:08.929Z", "dateUpdated": "2026-08-05T11:55:04.752Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:55:04.752Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free on inode when scanning root during em shrinking\n\nAt btrfs_scan_root() we are accessing the inode's root (and fs_info) in a\ncall to btrfs_fs_closing() after we have scheduled the inode for a delayed\niput, and that can result in a use-after-free on the inode in case the\ncleaner kthread does the iput before we dereference the inode in the call\nto btrfs_fs_closing().\n\nFix this by using the fs_info stored already in a local variable instead\nof doing inode->root->fs_info."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable `btrfs_extent_map_shrinker_worker` is reached only through the superblock shrinker (`btrfs_free_cached_objects()` \u2192 `btrfs_free_extent_maps()`) on a locally mounted btrfs filesystem, so the attacker must be able to generate local file I/O and memory pressure. No remote protocol data is parsed on this path.\nAC:L - The attacker drives both sides of the race \u2014 memory pressure queues the em shrinker work while concurrent unlink/subvolume-delete churn keeps the cleaner kthread active \u2014 and `btrfs_add_delayed_iput()` itself calls `wake_up_process(fs_info->cleaner_kthread)` immediately before the dangling dereference, so no attacker-uncontrollable timing is needed. Every inode the shrinker scans is a fresh attempt and the workload can be repeated indefinitely.\nPR:L - Any unprivileged local user with write access to a btrfs filesystem (the default root fs on Fedora, openSUSE, SteamOS and many NAS/appliance images, and common for container overlay storage) can populate extent maps and drive reclaim; there is no capability check, LSM gate, or admin-only ioctl anywhere on the path.\nUI:N - The attacker's own filesystem activity and memory-pressure workload trigger the shrinker worker and the cleaner kthread; no victim needs to mount, open, or otherwise interact with anything.\nS:U - The use-after-free occurs in a kernel workqueue worker against kernel slab memory within the same security authority as the vulnerable kernel; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a CWE-416 use-after-free where the freed `btrfs_inode` slab object is dereferenced as a pointer chain (`inode->root->fs_info`); an attacker who grooms `btrfs_inode_cachep` via concurrent inode allocation controls the contents at that offset, turning the dereference into a read at an attacker-influenced kernel address, and UAF windows on a dedicated inode cache are a well-established primitive for kernel memory disclosure.\nI:H - Use-after-free on a live slab object gives the attacker a dangling reference into memory that is concurrently reallocated and written by other inodes, which combined with heap grooming is the standard basis for corrupting adjacent kernel state and hijacking control flow. Scored high per the memory-corruption guidance rather than limited to the immediate observed symptom.\nA:H - Reading `inode->root` from the reallocated object commonly yields NULL (set by `btrfs_alloc_inode()`, and guaranteed under `init_on_free=1`) or garbage, producing a kernel oops in the em shrinker worker; with KASAN enabled it is a slab-use-after-free splat that panics under `panic_on_warn`."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/btrfs/extent_map.c"], "versions": [{"version": "fef55c4d9c9c22264d2b2ceae1e26922cb6129a5", "lessThan": "07836bc18f4ae42da4e922244f4685561c18755e", "status": "affected", "versionType": "git"}, {"version": "1020443840569535f6025a855958f07ea3eebf71", "lessThan": "5e79d26014f9386387575b9ed60d342057cee49b", "status": "affected", "versionType": "git"}, {"version": "1020443840569535f6025a855958f07ea3eebf71", "lessThan": "59f37036bb7ab3d554c24abc856aabca01126414", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/btrfs/extent_map.c"], "versions": [{"version": "6.13", "status": "affected"}, {"version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.13.6", "lessThanOrEqual": "6.13.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.14", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.13.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.14"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/07836bc18f4ae42da4e922244f4685561c18755e"}, {"url": "https://git.kernel.org/stable/c/5e79d26014f9386387575b9ed60d342057cee49b"}, {"url": "https://git.kernel.org/stable/c/59f37036bb7ab3d554c24abc856aabca01126414"}], "title": "btrfs: fix use-after-free on inode when scanning root during em shrinking", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-21879", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-03-28T15:22:49.038837Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-28T15:31:59.926Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-21879", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-03-28T15:22:49.038837Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-28T15:22:50.414Z"}}], "cna": {"title": "btrfs: fix use-after-free on inode when scanning root during em shrinking", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable `btrfs_extent_map_shrinker_worker` is reached only through the superblock shrinker (`btrfs_free_cached_objects()` \u2192 `btrfs_free_extent_maps()`) on a locally mounted btrfs filesystem, so the attacker must be able to generate local file I/O and memory pressure. No remote protocol data is parsed on this path.\nAC:L - The attacker drives both sides of the race \u2014 memory pressure queues the em shrinker work while concurrent unlink/subvolume-delete churn keeps the cleaner kthread active \u2014 and `btrfs_add_delayed_iput()` itself calls `wake_up_process(fs_info->cleaner_kthread)` immediately before the dangling dereference, so no attacker-uncontrollable timing is needed. Every inode the shrinker scans is a fresh attempt and the workload can be repeated indefinitely.\nPR:L - Any unprivileged local user with write access to a btrfs filesystem (the default root fs on Fedora, openSUSE, SteamOS and many NAS/appliance images, and common for container overlay storage) can populate extent maps and drive reclaim; there is no capability check, LSM gate, or admin-only ioctl anywhere on the path.\nUI:N - The attacker's own filesystem activity and memory-pressure workload trigger the shrinker worker and the cleaner kthread; no victim needs to mount, open, or otherwise interact with anything.\nS:U - The use-after-free occurs in a kernel workqueue worker against kernel slab memory within the same security authority as the vulnerable kernel; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a CWE-416 use-after-free where the freed `btrfs_inode` slab object is dereferenced as a pointer chain (`inode->root->fs_info`); an attacker who grooms `btrfs_inode_cachep` via concurrent inode allocation controls the contents at that offset, turning the dereference into a read at an attacker-influenced kernel address, and UAF windows on a dedicated inode cache are a well-established primitive for kernel memory disclosure.\nI:H - Use-after-free on a live slab object gives the attacker a dangling reference into memory that is concurrently reallocated and written by other inodes, which combined with heap grooming is the standard basis for corrupting adjacent kernel state and hijacking control flow. Scored high per the memory-corruption guidance rather than limited to the immediate observed symptom.\nA:H - Reading `inode->root` from the reallocated object commonly yields NULL (set by `btrfs_alloc_inode()`, and guaranteed under `init_on_free=1`) or garbage, producing a kernel oops in the em shrinker worker; with KASAN enabled it is a slab-use-after-free splat that panics under `panic_on_warn`."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "fef55c4d9c9c22264d2b2ceae1e26922cb6129a5", "lessThan": "07836bc18f4ae42da4e922244f4685561c18755e", "versionType": "git"}, {"status": "affected", "version": "1020443840569535f6025a855958f07ea3eebf71", "lessThan": "5e79d26014f9386387575b9ed60d342057cee49b", "versionType": "git"}, {"status": "affected", "version": "1020443840569535f6025a855958f07ea3eebf71", "lessThan": "59f37036bb7ab3d554c24abc856aabca01126414", "versionType": "git"}], "programFiles": ["fs/btrfs/extent_map.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"status": "unaffected", "version": "0", "lessThan": "6.13", "versionType": "semver"}, {"status": "unaffected", "version": "6.13.6", "versionType": "semver", "lessThanOrEqual": "6.13.*"}, {"status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/btrfs/extent_map.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/07836bc18f4ae42da4e922244f4685561c18755e"}, {"url": "https://git.kernel.org/stable/c/5e79d26014f9386387575b9ed60d342057cee49b"}, {"url": "https://git.kernel.org/stable/c/59f37036bb7ab3d554c24abc856aabca01126414"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free on inode when scanning root during em shrinking\n\nAt btrfs_scan_root() we are accessing the inode's root (and fs_info) in a\ncall to btrfs_fs_closing() after we have scheduled the inode for a delayed\niput, and that can result in a use-after-free on the inode in case the\ncleaner kthread does the iput before we dereference the inode in the call\nto btrfs_fs_closing().\n\nFix this by using the fs_info stored already in a local variable instead\nof doing inode->root->fs_info."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.13.6", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.14", "versionStartIncluding": "6.13"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:55:04.752Z"}}}, "cveMetadata": {"cveId": "CVE-2025-21879", "state": "PUBLISHED", "dateUpdated": "2026-08-05T11:55:04.752Z", "dateReserved": "2024-12-29T08:45:45.782Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-03-27T14:57:08.929Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/btrfs/extent_map.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "07836bc18f4ae42da4e922244f4685561c18755e", "status": "affected", "version": "fef55c4d9c9c22264d2b2ceae1e26922cb6129a5", "versionType": "git"}, {"lessThan": "5e79d26014f9386387575b9ed60d342057cee49b", "status": "affected", "version": "1020443840569535f6025a855958f07ea3eebf71", "versionType": "git"}, {"lessThan": "59f37036bb7ab3d554c24abc856aabca01126414", "status": "affected", "version": "1020443840569535f6025a855958f07ea3eebf71", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/btrfs/extent_map.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"lessThan": "6.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.13.*", "status": "unaffected", "version": "6.13.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.14", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "64F12D9B-71C2-4CD7-A288-0D5EF1709620", "versionEndExcluding": "6.13.6", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc1:*:*:*:*:*:*", "matchCriteriaId": "186716B6-2B66-4BD0-852E-D48E71C0C85F", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D3E781C-403A-498F-9DA9-ECEE50F41E75", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc3:*:*:*:*:*:*", "matchCriteriaId": "66619FB8-0AAF-4166-B2CF-67B24143261D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.14:rc4:*:*:*:*:*:*", "matchCriteriaId": "D3D6550E-6679-4560-902D-AF52DCFE905B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix use-after-free on inode when scanning root during em shrinking\n\nAt btrfs_scan_root() we are accessing the inode's root (and fs_info) in a\ncall to btrfs_fs_closing() after we have scheduled the inode for a delayed\niput, and that can result in a use-after-free on the inode in case the\ncleaner kthread does the iput before we dereference the inode in the call\nto btrfs_fs_closing().\n\nFix this by using the fs_info stored already in a local variable instead\nof doing inode->root->fs_info."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: se corrige el use-after-free en el inodo al escanear la ra\u00edz durante la reducci\u00f3n de em. En btrfs_scan_root(), accedemos a la ra\u00edz del inodo (y a fs_info) en una llamada a btrfs_fs_closing() despu\u00e9s de haber programado el inodo para una entrada retrasada, lo que puede resultar en un use-after-free en el inodo en caso de que el kthread m\u00e1s limpio realice la entrada antes de que desreferenciamos el inodo en la llamada a btrfs_fs_closing(). Se soluciona esto usando la fs_info ya almacenada en una variable local en lugar de hacer inode->root->fs_info."}], "id": "CVE-2025-21879", "lastModified": "2026-06-17T08:44:31.037", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-21879", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-03-28T15:22:49.038837Z", "version": "2.0.3"}}]}, "published": "2025-03-27T15:15:55.790", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/07836bc18f4ae42da4e922244f4685561c18755e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/59f37036bb7ab3d554c24abc856aabca01126414"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5e79d26014f9386387575b9ed60d342057cee49b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: btrfs: fix use-after-free on inode when scanning root during em shrinking", "id": "2355407", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2355407"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbtrfs: fix use-after-free on inode when scanning root during em shrinking\nAt btrfs_scan_root() we are accessing the inode's root (and fs_info) in a\ncall to btrfs_fs_closing() after we have scheduled the inode for a delayed\niput, and that can result in a use-after-free on the inode in case the\ncleaner kthread does the iput before we dereference the inode in the call\nto btrfs_fs_closing().\nFix this by using the fs_info stored already in a local variable instead\nof doing inode->root->fs_info."], "name": "CVE-2025-21879", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-03-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-21879\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-21879\nhttps://lore.kernel.org/linux-cve-announce/2025032711-CVE-2025-21879-f338@gregkh/T"], "threat_severity": "Low"}

{}