Critical Race Condition in Linux Kernel's Btrfs Package Leading to Refcount Underflow
Summary
DEBIAN-CVE-2025-22115: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix block group refcount race in btrfs_create_pending_block_groups() Block group creation is done in two phases, which results in a slightly unin... Affects linux versions < 6.12.41-1. Fixed in 6.12.41-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. The Btrfs (B-tree file system) is a modern file system for Linux that supports advanced features such as snapshots, dynamic inode allocation, and integrated multi-device support. However, it is susceptible to vulnerabilities that can compromise system stability and data integrity.
Vulnerability Detail
In the Linux kernel, a race condition exists in the Btrfs file system during the creation of block groups. This vulnerability arises from the improper handling of block group references, allowing concurrent operations to interfere with each other. Specifically, the function 'btrfs_create_pending_block_groups()' can be called while 'btrfs_mark_bg_unused' is also being executed, leading to a broken reference count and potential use-after-free errors. This can result in system warnings and instability, particularly during operations like async discard and block group relocation.
How To Fix
Minimum fixed version
6.12.41-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available.
Conclusion
The vulnerability in the Linux kernel's Btrfs file system represents a significant risk due to its potential to cause system instability and data integrity issues. Users are strongly encouraged to update their systems to the latest patched versions to mitigate this risk.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a race condition in the Btrfs file system that can lead to a refcount underflow and potential system instability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Exploitation of this vulnerability can lead to system warnings, instability, and potential data loss due to improper handling of block group references.
Yes, patches are available for Debian 13 (version 6.12.41-1) and Debian 14 (version 6.16.3-1).
While no specific workarounds are available, it is advisable to monitor your system for unusual behavior and apply the patch as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
