{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-38365", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T04:51:24.008Z", "datePublished": "2025-07-25T12:47:35.387Z", "dateUpdated": "2026-08-05T12:01:22.398Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:01:22.398Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix a race between renames and directory logging\n\nWe have a race between a rename and directory inode logging that if it\nhappens and we crash/power fail before the rename completes, the next time\nthe filesystem is mounted, the log replay code will end up deleting the\nfile that was being renamed.\n\nThis is best explained following a step by step analysis of an interleaving\nof steps that lead into this situation.\n\nConsider the initial conditions:\n\n1) We are at transaction N;\n\n2) We have directories A and B created in a past transaction (< N);\n\n3) We have inode X corresponding to a file that has 2 hardlinks, one in\n directory A and the other in directory B, so we'll name them as\n \"A/foo_link1\" and \"B/foo_link2\". Both hard links were persisted in a\n past transaction (< N);\n\n4) We have inode Y corresponding to a file that as a single hard link and\n is located in directory A, we'll name it as \"A/bar\". This file was also\n persisted in a past transaction (< N).\n\nThe steps leading to a file loss are the following and for all of them we\nare under transaction N:\n\n 1) Link \"A/foo_link1\" is removed, so inode's X last_unlink_trans field\n is updated to N, through btrfs_unlink() -> btrfs_record_unlink_dir();\n\n 2) Task A starts a rename for inode Y, with the goal of renaming from\n \"A/bar\" to \"A/baz\", so we enter btrfs_rename();\n\n 3) Task A inserts the new BTRFS_INODE_REF_KEY for inode Y by calling\n btrfs_insert_inode_ref();\n\n 4) Because the rename happens in the same directory, we don't set the\n last_unlink_trans field of directoty A's inode to the current\n transaction id, that is, we don't cal btrfs_record_unlink_dir();\n\n 5) Task A then removes the entries from directory A (BTRFS_DIR_ITEM_KEY\n and BTRFS_DIR_INDEX_KEY items) when calling __btrfs_unlink_inode()\n (actually the dir index item is added as a delayed item, but the\n effect is the same);\n\n 6) Now before task A adds the new entry \"A/baz\" to directory A by\n calling btrfs_add_link(), another task, task B is logging inode X;\n\n 7) Task B starts a fsync of inode X and after logging inode X, at\n btrfs_log_inode_parent() it calls btrfs_log_all_parents(), since\n inode X has a last_unlink_trans value of N, set at in step 1;\n\n 8) At btrfs_log_all_parents() we search for all parent directories of\n inode X using the commit root, so we find directories A and B and log\n them. Bu when logging direct A, we don't have a dir index item for\n inode Y anymore, neither the old name \"A/bar\" nor for the new name\n \"A/baz\" since the rename has deleted the old name but has not yet\n inserted the new name - task A hasn't called yet btrfs_add_link() to\n do that.\n\n Note that logging directory A doesn't fallback to a transaction\n commit because its last_unlink_trans has a lower value than the\n current transaction's id (see step 4);\n\n 9) Task B finishes logging directories A and B and gets back to\n btrfs_sync_file() where it calls btrfs_sync_log() to persist the log\n tree;\n\n10) Task B successfully persisted the log tree, btrfs_sync_log() completed\n with success, and a power failure happened.\n\n We have a log tree without any directory entry for inode Y, so the\n log replay code deletes the entry for inode Y, name \"A/bar\", from the\n subvolume tree since it doesn't exist in the log tree and the log\n tree is authorative for its index (we logged a BTRFS_DIR_LOG_INDEX_KEY\n item that covers the index range for the dentry that corresponds to\n \"A/bar\").\n\n Since there's no other hard link for inode Y and the log replay code\n deletes the name \"A/bar\", the file is lost.\n\nThe issue wouldn't happen if task B synced the log only after task A\ncalled btrfs_log_new_name(), which would update the log with the new name\nfor inode Y (\"A/bar\").\n\nFix this by pinning the log root during renames before removing the old\ndirectory entry, and unpinning af\n---truncated---" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "baseScore": 9.1, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable rename and fsync paths are plain VFS operations that a remote client can drive against a btrfs-backed writable ksmbd share or NFS export using SMB2 SET_INFO rename/hardlink plus FLUSH, or NFS RENAME/LINK plus COMMIT. No local access is required in that severe-but-realistic deployment, and log replay then runs automatically at the next mount.\nAC:L - The attacker owns both sides of the race — one thread issues the same-directory rename while another fsyncs an inode whose last_unlink_trans was armed by an unlink of a hard link — and btrfs_log_all_parents() takes no directory lock, so nothing blocks the interleaving. The window spans many btree operations between __btrfs_unlink_inode() and btrfs_add_link(), and the sequence can be looped indefinitely to keep the poisoned log persistently armed on disk until an unclean shutdown occurs.\nPR:N - The required operations (create, hard link, unlink, rename, fsync) need only ordinary write access to a directory, which an anonymous guest session on a ksmbd share or an AUTH_SYS NFS client — which asserts rather than proves its identity — already has. No Linux capability is checked anywhere along the path.\nUI:N - The attacker performs every operation that creates the inconsistent log state without any victim participation. Log replay is performed automatically by the kernel on the next mount after the unclean shutdown.\nS:U - The damage is confined to the btrfs filesystem and the kernel managing it, with no crossing into a hypervisor, IOMMU, container, or other distinct security authority.\nC:N - This is a crash-consistency/logging omission with no out-of-bounds read, use-after-free, or uninitialized memory exposure. Replay deletes data rather than exposing kernel memory or other principals' file contents.\nI:H - Replay unlinks a valid directory entry for a file that was already durably persisted in an earlier transaction, and with its last link gone the inode is orphaned and destroyed — unauthorized, unrecoverable deletion of committed filesystem data. If the affected entry is a directory, its entire subtree is orphaned, and on a shared writable directory or export the destroyed objects can belong to other principals.\nA:H - The lost files are permanently unavailable after recovery, and losing a configuration, database, or system file that an application was renaming can render dependent services or an embedded/appliance system inoperable. Loss of an entire directory subtree amplifies this to filesystem-wide unavailability of that data." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/btrfs/inode.c" ], "versions": [ { "version": "259c4b96d78dda8477a3ac21d6b3cf0eb9f75c8b", "lessThan": "51bd363c7010d033d3334daf457c824484bf9bf0", "status": "affected", "versionType": "git" }, { "version": "259c4b96d78dda8477a3ac21d6b3cf0eb9f75c8b", "lessThan": "aeeae8feeaae4445a86f9815273e81f902dc1f5b", "status": "affected", "versionType": "git" }, { "version": "259c4b96d78dda8477a3ac21d6b3cf0eb9f75c8b", "lessThan": "2088895d5903082bb9021770b919e733c57edbc1", "status": "affected", "versionType": "git" }, { "version": "259c4b96d78dda8477a3ac21d6b3cf0eb9f75c8b", "lessThan": "8c6874646c21bd820cf475e2874e62c133954023", "status": "affected", "versionType": "git" }, { "version": "259c4b96d78dda8477a3ac21d6b3cf0eb9f75c8b", "lessThan": "3ca864de852bc91007b32d2a0d48993724f4abad", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/btrfs/inode.c" ], "versions": [ { "version": "5.18", "status": "affected" }, { "version": "0", "lessThan": "5.18", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.143", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.96", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.36", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.15.5", "lessThanOrEqual": "6.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.16", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.1.143" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.6.96" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.12.36" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.15.5" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.16" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/51bd363c7010d033d3334daf457c824484bf9bf0" }, { "url": "https://git.kernel.org/stable/c/aeeae8feeaae4445a86f9815273e81f902dc1f5b" }, { "url": "https://git.kernel.org/stable/c/2088895d5903082bb9021770b919e733c57edbc1" }, { "url": "https://git.kernel.org/stable/c/8c6874646c21bd820cf475e2874e62c133954023" }, { "url": "https://git.kernel.org/stable/c/3ca864de852bc91007b32d2a0d48993724f4abad" } ], "title": "btrfs: fix a race between renames and directory logging", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:37:08.605Z" } } ] } }