{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-68359", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-16T14:48:05.305Z", "datePublished": "2025-12-24T10:32:48.456Z", "dateUpdated": "2026-08-05T12:11:01.831Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:11:01.831Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix double free of qgroup record after failure to add delayed ref head\n\nIn the previous code it was possible to incur into a double kfree()\nscenario when calling add_delayed_ref_head(). This could happen if the\nrecord was reported to already exist in the\nbtrfs_qgroup_trace_extent_nolock() call, but then there was an error\nlater on add_delayed_ref_head(). In this case, since\nadd_delayed_ref_head() returned an error, the caller went to free the\nrecord. Since add_delayed_ref_head() couldn't set this kfree'd pointer\nto NULL, then kfree() would have acted on a non-NULL 'record' object\nwhich was pointing to memory already freed by the callee.\n\nThe problem comes from the fact that the responsibility to kfree the\nobject is on both the caller and the callee at the same time. Hence, the\nfix for this is to shift the ownership of the 'qrecord' object out of\nthe add_delayed_ref_head(). That is, we will never attempt to kfree()\nthe given object inside of this function, and will expect the caller to\nact on the 'qrecord' object on its own. The only exception where the\n'qrecord' object cannot be kfree'd is if it was inserted into the\ntracing logic, for which we already have the 'qrecord_inserted_ret'\nboolean to account for this. Hence, the caller has to kfree the object\nonly if add_delayed_ref_head() reports not to have inserted it on the\ntracing logic.\n\nAs a side-effect of the above, we must guarantee that\n'qrecord_inserted_ret' is properly initialized at the start of the\nfunction, not at the end, and then set when an actual insert\nhappens. This way we avoid 'qrecord_inserted_ret' having an invalid\nvalue on an early exit.\n\nThe documentation from the add_delayed_ref_head() has also been updated\nto reflect on the exact ownership of the 'qrecord' object." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - NFSv4.2 DEALLOCATE and ksmbd FSCTL_SET_ZERO_DATA can remotely invoke hole punching on exported Btrfs files, reaching the vulnerable delayed-reference path.\nAC:L - An attacker can repeatedly manipulate shared extents, issue concurrent deallocations, and drive delayed-reference processing and memory pressure; both sides of the required race are attacker-influenceable.\nPR:N - An anonymous writable NFS export or writable ksmbd guest share permits the required operations without credentials or kernel capabilities.\nUI:N - Once qgroup accounting and the writable export are configured, exploitation requires no action by another user.\nS:U - The corruption compromises the same host-kernel security authority and does not cross a virtualization or other security-scope boundary.\nC:H - The double free can corrupt the slab freelist and produce overlapping allocations, enabling kernel-memory disclosure and arbitrary reads.\nI:H - Freelist corruption and overlapping allocations can provide attacker-controlled kernel writes and control-flow hijacking.\nA:H - Freelist hardening can immediately trigger a BUG, while unhardened allocators suffer freelist corruption that can crash or panic the kernel repeatedly." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/btrfs/delayed-ref.c" ], "versions": [ { "version": "6ef8fbce010421bf742b12b8f8f2b2d2ff154845", "lessThan": "7617680769e3119dfb3b43a2b7c287ce2242211c", "status": "affected", "versionType": "git" }, { "version": "6ef8fbce010421bf742b12b8f8f2b2d2ff154845", "lessThan": "364685c4c2d9c9f4408d95451bcf42fdeebc3ebb", "status": "affected", "versionType": "git" }, { "version": "6ef8fbce010421bf742b12b8f8f2b2d2ff154845", "lessThan": "725e46298876a2cc1f1c3fb22ba69d29102c3ddf", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/btrfs/delayed-ref.c" ], "versions": [ { "version": "6.12", "status": "affected" }, { "version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver" }, { "version": "6.17.13", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.2", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.17.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.19" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/7617680769e3119dfb3b43a2b7c287ce2242211c" }, { "url": "https://git.kernel.org/stable/c/364685c4c2d9c9f4408d95451bcf42fdeebc3ebb" }, { "url": "https://git.kernel.org/stable/c/725e46298876a2cc1f1c3fb22ba69d29102c3ddf" } ], "title": "btrfs: fix double free of qgroup record after failure to add delayed ref head", "x_generator": { "engine": "bippy-1.2.0" } } } }