Critical Race Condition in Linux Kernel's Btrfs Package: CVE-2025-37856
Summary
CVE-2025-37856: In the Linux kernel, the following vulnerability has been resolved: btrfs: harden block_group::bg_list against list_del() races As far as I can tell, these calls of list_del_init() on bg_list cannot run concurrently with... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential functionalities such as process management, memory management, and hardware abstraction. Btrfs, or B-tree file system, is a modern file system for Linux that offers advanced features like snapshots, dynamic inode allocation, and built-in RAID capabilities. However, it is susceptible to vulnerabilities that can compromise system stability and data integrity.
Vulnerability Detail
CVE-2025-37856 is a race condition vulnerability in the Btrfs file system within the Linux kernel. The issue arises from concurrent operations on the block group list, specifically during the execution of list_del_init() and btrfs_mark_bg_unused() or btrfs_mark_bg_to_reclaim(). This can lead to a broken reference count, causing potential system crashes and data corruption due to premature dereferencing of memory. The vulnerability is particularly concerning as it can occur in transaction error paths and situations where the block group is read-only, increasing the risk of exploitation.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, no specific workaround is provided for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
CVE-2025-37856 presents a significant risk to systems utilizing the Btrfs file system in the Linux kernel. It is essential to stay informed about this vulnerability and apply the necessary updates to ensure system integrity and security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37856 is a vulnerability in the Linux kernel's Btrfs file system that can lead to a race condition, potentially causing system instability and data corruption.
If exploited, this vulnerability can result in a broken reference count, leading to crashes and data loss, particularly in systems using the Btrfs file system.
Versions of Linux using the Btrfs file system are affected. It is crucial to check your package version and update to the patched version if necessary.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
While no specific workaround is available, it is advisable to monitor your system closely and apply the patch as soon as possible to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
