{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-37931", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:23.970Z", "datePublished": "2025-05-20T15:21:56.627Z", "dateUpdated": "2026-08-05T11:58:27.222Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:58:27.222Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: adjust subpage bit start based on sectorsize\n\nWhen running machines with 64k page size and a 16k nodesize we started\nseeing tree log corruption in production. This turned out to be because\nwe were not writing out dirty blocks sometimes, so this in fact affects\nall metadata writes.\n\nWhen writing out a subpage EB we scan the subpage bitmap for a dirty\nrange. If the range isn't dirty we do\n\n\tbit_start++;\n\nto move onto the next bit. The problem is the bitmap is based on the\nnumber of sectors that an EB has. So in this case, we have a 64k\npagesize, 16k nodesize, but a 4k sectorsize. This means our bitmap is 4\nbits for every node. With a 64k page size we end up with 4 nodes per\npage.\n\nTo make this easier this is how everything looks\n\n[0 16k 32k 48k ] logical address\n[0 4 8 12 ] radix tree offset\n[ 64k page ] folio\n[ 16k eb ][ 16k eb ][ 16k eb ][ 16k eb ] extent buffers\n[ | | | | | | | | | | | | | | | | ] bitmap\n\nNow we use all of our addressing based on fs_info->sectorsize_bits, so\nas you can see the above our 16k eb->start turns into radix entry 4.\n\nWhen we find a dirty range for our eb, we correctly do bit_start +=\nsectors_per_node, because if we start at bit 0, the next bit for the\nnext eb is 4, to correspond to eb->start 16k.\n\nHowever if our range is clean, we will do bit_start++, which will now\nput us offset from our radix tree entries.\n\nIn our case, assume that the first time we check the bitmap the block is\nnot dirty, we increment bit_start so now it == 1, and then we loop\naround and check again. This time it is dirty, and we go to find that\nstart using the following equation\n\n\tstart = folio_start + bit_start * fs_info->sectorsize;\n\nso in the case above, eb->start 0 is now dirty, and we calculate start\nas\n\n\t0 + 1 * fs_info->sectorsize = 4096\n\t4096 >> 12 = 1\n\nNow we're looking up the radix tree for 1, and we won't find an eb.\nWhat's worse is now we're using bit_start == 1, so we do bit_start +=\nsectors_per_node, which is now 5. If that eb is dirty we will run into\nthe same thing, we will look at an offset that is not populated in the\nradix tree, and now we're skipping the writeout of dirty extent buffers.\n\nThe best fix for this is to not use sectorsize_bits to address nodes,\nbut that's a larger change. Since this is a fs corruption problem fix\nit simply by always using sectors_per_node to increment the start bit." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H", "baseScore": 7.3, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The defect is in btrfs metadata writeback, reached through local filesystem syscalls — `write()`/`fsync()` on a file in a mounted btrfs subvolume driving `btrfs_write_marked_extents()` → `filemap_fdatawrite_range()` → `submit_eb_subpage()`. No network protocol handler parses remote data on this path.\nAC:L - In the affected configuration (nodesize < PAGE_SIZE, the standard 64K-page + 4K-sector/16K-node subpage setup shipped by arm64/ppc64 distros) an unprivileged user triggers it deterministically by producing a folio with a clean extent buffer preceding a dirty one and calling fsync; the maintainer hit it under ordinary production workloads. There is no race to win and no memory-layout condition outside the attacker's influence.\nPR:L - Any local account with write access to a btrfs filesystem (e.g. /home or /tmp on btrfs) can dirty metadata blocks and force log/transaction writeback via fsync. No capabilities, root, or namespace privileges are needed.\nUI:N - The attacker performs the writes and fsync calls themselves against an already-mounted filesystem; no victim action, mount, or file-open by another user is required.\nS:U - The corruption is confined to the on-disk state of the filesystem managed by the same kernel that contains the bug, crossing no hypervisor, IOMMU, or sandbox boundary.\nC:L - The flaw itself is a missed write with no out-of-bounds or freed-memory read, so it exposes nothing directly; however, committing a superblock over unwritten extent-tree and csum-tree blocks leaves allocator/checksum bookkeeping stale, which can leave file extent items pointing at reallocated blocks and yield another file's contents on nodatasum/nodatacow files where no checksum catches it — a real but indirect exposure.\nI:H - Dirty metadata is silently dropped while the superblock is advanced to reference it, producing permanent, undetected on-disk corruption of arbitrary btrfs trees — root tree, extent tree, csum tree, or any subvolume's fs tree — so an unprivileged user's writes can destroy metadata and data belonging to any user on the filesystem.\nA:H - The resulting stale blocks fail generation validation on the next read (\"parent transid verify failed\"), causing EIO, transaction abort and forced read-only remount, and a corrupt tree log that makes log replay fail so the filesystem will not mount read-write — up to total loss of availability of the affected volume, including a root filesystem." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/btrfs/extent_io.c" ], "versions": [ { "version": "c4aec299fa8f73f0fd10bc556f936f0da50e3e83", "lessThan": "5111b148360f50cac9abbae8fca44cc0ac4bf9bf", "status": "affected", "versionType": "git" }, { "version": "c4aec299fa8f73f0fd10bc556f936f0da50e3e83", "lessThan": "977849e8acd2466ac3cb49e04a3ecc73837f6b90", "status": "affected", "versionType": "git" }, { "version": "c4aec299fa8f73f0fd10bc556f936f0da50e3e83", "lessThan": "b80db09b614cb7edec5bada1bc7c7b0eb3b453ea", "status": "affected", "versionType": "git" }, { "version": "c4aec299fa8f73f0fd10bc556f936f0da50e3e83", "lessThan": "396f4002710030ea1cfd4c789ebaf0a6969ab34f", "status": "affected", "versionType": "git" }, { "version": "c4aec299fa8f73f0fd10bc556f936f0da50e3e83", "lessThan": "e08e49d986f82c30f42ad0ed43ebbede1e1e3739", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/btrfs/extent_io.c" ], "versions": [ { "version": "5.13", "status": "affected" }, { "version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.151", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.105", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.28", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.14.6", "lessThanOrEqual": "6.14.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.1.151" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.105" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.12.28" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.14.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.15" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/5111b148360f50cac9abbae8fca44cc0ac4bf9bf" }, { "url": "https://git.kernel.org/stable/c/977849e8acd2466ac3cb49e04a3ecc73837f6b90" }, { "url": "https://git.kernel.org/stable/c/b80db09b614cb7edec5bada1bc7c7b0eb3b453ea" }, { "url": "https://git.kernel.org/stable/c/396f4002710030ea1cfd4c789ebaf0a6969ab34f" }, { "url": "https://git.kernel.org/stable/c/e08e49d986f82c30f42ad0ed43ebbede1e1e3739" } ], "title": "btrfs: adjust subpage bit start based on sectorsize", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:32:41.737Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T12:04:20.601Z" }, "affected": [ { "vendor": "Siemens", "product": "SIMATIC CN 4100", "versions": [ { "status": "affected", "version": "0", "lessThan": "V5.0", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-032379.html" } ] } ] } }