Critical Race Condition in Linux Kernel's Btrfs Package: CVE-2025-37856
Summary
DEBIAN-CVE-2025-37856: In the Linux kernel, the following vulnerability has been resolved: btrfs: harden block_group::bg_list against list_del() races As far as I can tell, these calls of list_del_init() on bg_list cannot run concurrently with... Affects linux versions < 6.12.25-1. Fixed in 6.12.25-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including Debian. It manages hardware resources and provides essential services for software applications. The Btrfs (B-tree file system) is a modern file system for Linux that offers advanced features like snapshots, dynamic inode allocation, and built-in RAID capabilities. However, it is susceptible to race conditions, which can lead to serious issues if not addressed promptly.
Vulnerability Detail
In the Linux kernel, a race condition vulnerability has been identified in the Btrfs file system, specifically related to the handling of the block_group's bg_list. The vulnerability arises from the concurrent execution of list_del_init() and btrfs_mark_bg_unused() or btrfs_mark_bg_to_reclaim(), which can lead to a broken reference count. This may result in an underflow of the reference count, causing potential system instability and crashes. The vulnerability is particularly concerning as it can be exploited in transaction error paths, where the block group is marked as read-only.
How To Fix
Minimum fixed version
6.12.25-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is highly recommended to apply the patch as soon as it is available to mitigate any risks.
Conclusion
The CVE-2025-37856 vulnerability in the Linux kernel's Btrfs file system poses significant risks due to a race condition that can lead to system instability. Users are urged to update their kernel to the patched version 6.12.25-1 or later to mitigate these risks. Regular monitoring of vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-37856 is a vulnerability in the Linux kernel's Btrfs file system that can lead to a race condition and broken reference counts.
Exploitation of this vulnerability can lead to system instability, crashes, and potential data loss due to improper handling of file system operations.
If you are using versions prior to 6.12.25-1, your system is at risk. It is advisable to check your kernel version and update accordingly.
You can check your Linux kernel version by running the command 'uname -r' in the terminal.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
