CVE - CVE-2025-37856

CVE-ID
CVE-2025-37856	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: harden block_group::bg_list against list_del() races As far as I can tell, these calls of list_del_init() on bg_list cannot run concurrently with btrfs_mark_bg_unused() or btrfs_mark_bg_to_reclaim(), as they are in transaction error paths and situations where the block group is readonly. However, if there is any chance at all of racing with mark_bg_unused(), or a different future user of bg_list, better to be safe than sorry. Otherwise we risk the following interleaving (bg_list refcount in parens) T1 (some random op) T2 (btrfs_mark_bg_unused) !list_empty(&bg->bg_list); (1) list_del_init(&bg->bg_list); (1) list_move_tail (1) btrfs_put_block_group (0) btrfs_delete_unused_bgs bg = list_first_entry list_del_init(&bg->bg_list); btrfs_put_block_group(bg); (-1) Ultimately, this results in a broken ref count that hits zero one deref early and the real final deref underflows the refcount, resulting in a WARNING.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/185fd73e5ac06027c4be9a129e59193f6a3ef202 URL:https://git.kernel.org/stable/c/185fd73e5ac06027c4be9a129e59193f6a3ef202 MISC:https://git.kernel.org/stable/c/7511e29cf1355b2c47d0effb39e463119913e2f6 URL:https://git.kernel.org/stable/c/7511e29cf1355b2c47d0effb39e463119913e2f6 MISC:https://git.kernel.org/stable/c/909e60fb469d4101c6b08cf6e622efb062bb24a1 URL:https://git.kernel.org/stable/c/909e60fb469d4101c6b08cf6e622efb062bb24a1 MISC:https://git.kernel.org/stable/c/bf089c4d1141b27332c092b1dcca5022c415a3b6 URL:https://git.kernel.org/stable/c/bf089c4d1141b27332c092b1dcca5022c415a3b6
Assigning CNA
kernel.org
Date Record Created
20250416	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20250416)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)