In the Linux kernel, the following vulnerability has been resolved:
btrfs: ref-verify: fix use-after-free after invalid ref action
At btrfs_ref_tree_mod() after we successfully inserted the new ref entry (local variable 'ref') into the respective block entry's rbtree (local variable 'be'), if we find an unexpected action of BTRFS_DROP_DELAYED_REF, we error out and free the ref entry without removing it from the block entry's rbtree. Then in the error path of btrfs_ref_tree_mod() we call btrfs_free_ref_cache(), which iterates over all block entries and then calls free_block_entry() for each one, and there we will trigger a use-after-free when we are called against the block entry to which we added the freed ref entry to its rbtree, since the rbtree still points to the block entry, as we didn't remove it from the rbtree before freeing it in the error path at btrfs_ref_tree_mod(). Fix this by removing the new ref entry from the rbtree before freeing it.
Syzbot report this with the following stack traces:
BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_insert_empty_items+0x9c/0x1a0 fs/btrfs/ctree.c:4314 btrfs_insert_empty_item fs/btrfs/ctree.h:669 [inline] btrfs_insert_orphan_item+0x1f1/0x320 fs/btrfs/orphan.c:23 btrfs_orphan_add+0x6d/0x1a0 fs/btrfs/inode.c:3482 btrfs_unlink+0x267/0x350 fs/btrfs/inode.c:4293 vfs_unlink+0x365/0x650 fs/namei.c:4469 do_unlinkat+0x4ae/0x830 fs/namei.c:4533 __do_sys_unlinkat fs/namei.c:4576 [inline] __se_sys_unlinkat fs/namei.c:4569 [inline] __x64_sys_unlinkat+0xcc/0xf0 fs/namei.c:4569 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f BTRFS error (device loop0 state EA): Ref action 1, root 5, ref_root 5, parent 0, owner 260, offset 0, num_refs 1 __btrfs_mod_ref+0x76b/0xac0 fs/btrfs/extent-tree.c:2521 update_ref_for_cow+0x96a/0x11f0 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline] __btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137 __btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171 btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313 prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586 relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611 btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081 btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377 __btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161 btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538 BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615 __btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523 update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512 btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594 btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754 btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116 btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411 __btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030 btrfs_update_delayed_i ---truncated---
CVSS Details
- CVSS 3.1 Base Score: 7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python-perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-headersUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-livepatch-5.15.176-118.170Upgrade python-perfUpgrade kernel-livepatch-5.10.233-223.887Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade kernelUpgrade perf-debuginfoUpgrade perfUpgrade kernel-debuginfoUpgrade kernel-develUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64 | Mar 4, 2025 | Dec 27, 2024 |
| Amazon_linux_2023 | — | Upgrade kernel-tools-develUpgrade kernel-develUpgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade python3-perfUpgrade python3-perf-debuginfoUpgrade perfUpgrade kernel-toolsUpgrade bpftoolUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-libbpfUpgrade kernel-modules-extraUpgrade kernel-libbpf-staticUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-headersUpgrade kernel-libbpf-develUpgrade kernelUpgrade kernel-livepatch-6.1.124-134.200Upgrade kernel-modules-extra-commonUpgrade bpftool-debuginfo | Mar 10, 2025 | Dec 27, 2024 |
| Debian | — | Upgrade linuxUpgrade linux-6.1 | Jan 13, 2025 | Dec 27, 2024 |
| Oracle_linux | — | Upgrade kernel-uek | Feb 11, 2025 | Dec 27, 2024 |
| Ubuntu | — | Upgrade linux-image-4.15.0-1151-oracleUpgrade linux-image-5.15.0-1077-oracleUpgrade linux-image-azure-lts-22.04Upgrade linux-image-4.15.0-247-lowlatencyUpgrade linux-image-5.4.0-1145-gcpUpgrade linux-image-5.4.0-1088-ibmUpgrade linux-image-intelUpgrade linux-image-lowlatency-64kUpgrade linux-image-5.15.0-1074-raspiUpgrade linux-image-6.8.0-58-lowlatency-64kUpgrade linux-image-5.15.0-136-generic-lpaeUpgrade linux-image-realtime-hwe-24.04Upgrade linux-image-5.15.0-1077-intel-iotgUpgrade linux-image-5.15.0-1080-awsUpgrade linux-image-5.4.0-1129-kvmUpgrade linux-image-6.8.0-1028-gcpUpgrade linux-image-5.4.0-1145-gcp-fipsUpgrade linux-image-5.15.0-1080-realtimeUpgrade linux-image-oem-20.04bUpgrade linux-image-5.4.0-211-lowlatencyUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-5.15.0-135-genericUpgrade linux-image-oem-22.04cUpgrade linux-image-oem-osp1Upgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-raspi-realtimeUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-lowlatency-64k-hwe-24.04Upgrade linux-image-nvidia-tegraUpgrade linux-image-raspi2Upgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1024-oracleUpgrade linux-image-6.8.1-1020-realtimeUpgrade linux-image-azureUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-oracle-lts-20.04Upgrade linux-image-genericUpgrade linux-image-oem-22.04dUpgrade linux-image-gcp-4.15Upgrade linux-image-5.15.0-1021-nvidia-tegra-igx-rtUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-5.15.0-1033-nvidia-tegraUpgrade linux-image-5.15.0-1076-kvmUpgrade linux-image-6.8.0-1028-gcp-64kUpgrade linux-image-generic-64kUpgrade linux-image-5.15.0-135-lowlatencyUpgrade linux-image-4.15.0-1182-gcpUpgrade linux-image-oem-22.04bUpgrade linux-image-5.15.0-1084-azureUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-5.15.0-1075-intel-iotgUpgrade linux-image-5.4.0-1147-azure-fipsUpgrade linux-image-4.15.0-2106-azure-fipsUpgrade linux-image-6.8.0-1027-azure-fdeUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-4.15.0-1197-azureUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1026-nvidia-64kUpgrade linux-image-nvidiaUpgrade linux-image-5.15.0-1033-nvidia-tegra-rtUpgrade linux-image-4.15.0-1171-kvmUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-5.15.0-1074-nvidiaUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oem-20.04Upgrade linux-image-5.4.0-1147-azureUpgrade linux-image-oem-24.04aUpgrade linux-image-6.11.0-1007-realtimeUpgrade linux-image-aws-lts-24.04Upgrade linux-image-oem-20.04cUpgrade linux-image-azure-4.15Upgrade linux-image-ibmUpgrade linux-image-4.15.0-1144-fipsUpgrade linux-image-gcp-fips-4.15Upgrade linux-image-6.8.0-1027-awsUpgrade linux-image-azure-lts-18.04Upgrade linux-image-5.4.0-1090-ibmUpgrade linux-image-gkeop-5.15Upgrade linux-image-gke-5.15Upgrade linux-image-oemUpgrade linux-image-oracle-4.15Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-gkeUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.15.0-1021-nvidia-tegra-igxUpgrade linux-image-5.15.0-135-generic-64kUpgrade linux-image-4.15.0-1189-awsUpgrade linux-image-intel-iotgUpgrade linux-image-virtual-hwe-20.04Upgrade linux-image-5.15.0-1077-gkeUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.15.0-1079-gcpUpgrade linux-image-5.15.0-1083-azure-fipsUpgrade linux-image-oem-22.04aUpgrade linux-image-5.15.0-1072-ibmUpgrade linux-image-gkeop-6.8Upgrade linux-image-oracle-64kUpgrade linux-image-5.4.0-1142-aws-fipsUpgrade linux-image-6.11.0-1013-oracleUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-5.15.0-1086-azureUpgrade linux-image-oem-20.04dUpgrade linux-image-aws-4.15Upgrade linux-image-6.8.0-1026-oemUpgrade linux-image-aws-lts-18.04Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-gkeopUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-6.8.0-1026-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1026-nvidiaUpgrade linux-image-5.15.0-1086-azure-fdeUpgrade linux-image-6.8.0-1027-azureUpgrade linux-image-aws-fips-4.15Upgrade linux-image-oracle-lts-22.04Upgrade linux-image-5.15.0-1073-intel-iot-realtimeUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-virtualUpgrade linux-image-5.15.0-135-lowlatency-64kUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-4.15.0-247-genericUpgrade linux-image-lowlatencyUpgrade linux-image-gcpUpgrade linux-image-lowlatency-hwe-24.04Upgrade linux-image-nvidia-64kUpgrade linux-image-6.11.0-21-genericUpgrade linux-image-oem-24.04Upgrade linux-image-virtual-hwe-22.04Upgrade linux-image-azure-nvidiaUpgrade linux-image-azure-lts-20.04Upgrade linux-image-6.11.0-1012-azure-fdeUpgrade linux-image-ibm-classicUpgrade linux-image-aws-lts-20.04Upgrade linux-image-5.15.0-1081-gcpUpgrade linux-image-6.11.0-1012-azureUpgrade linux-image-5.4.0-1116-fipsUpgrade linux-image-azure-fdeUpgrade linux-image-bluefieldUpgrade linux-image-5.15.0-1074-nvidia-lowlatencyUpgrade linux-image-azure-cvmUpgrade linux-image-6.8.0-58-genericUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-6.11.0-1011-lowlatencyUpgrade linux-image-awsUpgrade linux-image-gcp-64kUpgrade linux-image-5.15.0-135-generic-lpaeUpgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-azure-lts-24.04Upgrade linux-image-6.8.0-1024-ibmUpgrade linux-image-5.15.0-136-genericUpgrade linux-image-azure-fips-4.15Upgrade linux-image-oracleUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-gcp-lts-22.04Upgrade linux-image-aws-hweUpgrade linux-image-6.11.0-1010-raspiUpgrade linux-image-6.8.0-1024-oracle-64kUpgrade linux-image-5.4.0-1129-raspiUpgrade linux-image-6.8.0-1010-gkeopUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-5.15.0-135-fipsUpgrade linux-image-6.11.0-21-generic-64kUpgrade linux-image-4.15.0-2090-gcp-fipsUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.8.0-1026-nvidia-lowlatencyUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-ibm-lts-20.04Upgrade linux-image-5.4.0-1142-awsUpgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.11.0-1011-gcp-64kUpgrade linux-image-gcp-fipsUpgrade linux-image-5.15.0-1079-gcp-fipsUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-generic-lpaeUpgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-kvmUpgrade linux-image-5.15.0-136-generic-64kUpgrade linux-image-5.4.0-211-genericUpgrade linux-image-5.15.0-1062-gkeopUpgrade linux-image-5.4.0-1101-bluefieldUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-realtimeUpgrade linux-image-6.11.0-1017-oemUpgrade linux-image-4.15.0-2127-aws-fipsUpgrade linux-image-5.4.0-211-generic-lpaeUpgrade linux-image-6.8.0-1028-raspiUpgrade linux-image-raspi-nolpaeUpgrade linux-image-5.4.0-1140-oracleUpgrade linux-image-6.8.0-58-lowlatencyUpgrade linux-image-azure-fipsUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-nvidia-tegra-igxUpgrade linux-image-oem-24.04bUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-raspiUpgrade linux-image-5.4.0-1060-xilinx-zynqmpUpgrade linux-image-5.15.0-1044-xilinx-zynqmpUpgrade linux-image-6.8.0-2023-raspi-realtimeUpgrade linux-image-6.8.0-1023-gkeUpgrade linux-image-6.11.0-1011-awsUpgrade linux-image-6.11.0-1013-oracle-64kUpgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-1014-azure-nvidiaUpgrade linux-image-aws-lts-22.04Upgrade linux-image-5.15.0-1074-ibmUpgrade linux-image-6.11.0-1011-lowlatency-64kUpgrade linux-image-fipsUpgrade linux-image-5.4.0-1048-iotUpgrade linux-image-5.15.0-1080-aws-fipsUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.11.0-1011-gcpUpgrade linux-image-aws-fipsUpgrade linux-image-6.8.0-58-generic-64kUpgrade linux-image-nvidia-tegra-rt | Mar 28, 2025 | Dec 27, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 13, 2025 | Dec 27, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub