Critical Btrfs Assertion Failure in Linux Kernel - CVE-2025-21754
Summary
DEBIAN-CVE-2025-21754: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix assertion failure when splitting ordered extent after transaction abort If while we are doing a direct IO write a transaction abort happens,... Affects linux versions < 6.12.15-1. Fixed in 6.12.15-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It supports a wide range of functionalities, including process management, memory management, and file systems. The Btrfs file system, known for its advanced features like snapshots and dynamic inode allocation, is particularly vulnerable in this instance due to a flaw in handling ordered extents during direct I/O operations.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the Btrfs file system that can lead to an assertion failure when splitting ordered extents after a transaction abort. This occurs when a direct I/O write is interrupted by a transaction abort, causing existing ordered extents to be marked with the BTRFS_ORDERED_IOERR flag. If the system then attempts to split an ordered extent that still has remaining bytes, it triggers an assertion failure due to the presence of the BTRFS_ORDERED_IOERR flag. This can lead to system instability and potential data loss, as the kernel fails to handle the error condition correctly.
How To Fix
Minimum fixed version
6.12.15-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch by updating the Linux kernel to the fixed version.
Conclusion
The CVE-2025-21754 vulnerability in the Linux kernel's Btrfs file system poses significant risks, including system instability and data loss. It is crucial for users to update their systems to the patched version to mitigate these risks effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2025-21754 is a vulnerability in the Linux kernel's Btrfs file system that can cause assertion failures during direct I/O operations after a transaction abort.
This vulnerability can lead to system instability and potential data loss if the kernel fails to handle the error condition correctly.
You should update your Linux package to version 6.12.15-1 or later to fix the vulnerability.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software by analyzing a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
