Cloudanix VulnDB

CVE-2023-53865

None

CVSS

—

EPSS

0.2%

Published

Dec 9, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux file-system bug can produce confusing warning messages after certain failed operations when quota tracking is turned on.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The btrfs_qgroup_destroy_extent_records function frees nodes from the delayed_refs.dirty_extent_root rbtree during transaction abort with qgroups enabled but fails to reset the rbtree root to RB_ROOT, leaving stale pointers that trigger a WARN_ON in btrfs_put_transaction.

Why it matters to the business

Systems using Btrfs with quota groups may experience spurious kernel warnings and minor operational noise after transaction aborts, with limited risk of broader instability but requiring prompt patching on production kernels.

How an attack unfolds

An attacker would need to trigger a Btrfs transaction abort while qgroups are active, after which the kernel logs a warning on transaction cleanup; no remote code execution or privilege escalation path exists from this logic error.

How to fix it

Upgrade the Linux kernel to a fixed version such as 5.4.251 or later, or apply commit ae91ab710d8e309f6c9eba07ce0d9d0b5d9040f0; ensure qgroups remain enabled only on patched kernels.

How to confirm the fix worked

Confirm the presence of the fix by checking that btrfs_qgroup_destroy_extent_records assigns RB_ROOT to dirty_extent_root before returning, then reproduce an abort scenario and verify absence of the warning.

Typical attack path

  1. Enable Btrfs quota groups on a volume
  2. Induce conditions that abort a transaction (e.g., via crafted I/O or resource exhaustion)
  3. Observe the warning in btrfs_put_transaction during final transaction put

How to detect it

Search kernel logs for the exact WARNING line referencing btrfs_put_transaction and delayed_refs.dirty_extent_root after any observed Btrfs transaction abort.

  • WARNING: CPU.*btrfs_put_transaction.*dirty_extent_root
  • btrfs: fix warning when putting transaction with qgroups enabled after abort

What your security team should do

  • Prioritize kernel updates on all Btrfs hosts using qgroups
  • Monitor for transaction abort events in kernel logs
  • Test qgroup workloads on patched kernels before broad deployment

The record

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix warning when putting transaction with qgroups enabled after abort If we have a transaction abort with qgroups enabled we get a warning triggered when doing the final put on the transaction, like this: [552.6789] ------------[ cut here ]------------ [552.6815] WARNING: CPU: 4 PID: 81745 at fs/btrfs/transaction.c:144 btrfs_put_transaction+0x123/0x130 [btrfs] [552.6817] Modules linked in: btrfs blake2b_generic xor (...) [552.6819] CPU: 4 PID: 81745 Comm: btrfs-transacti Tainted: G W 6.4.0-rc6-btrfs-next-134+ #1 [552.6819] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014 [552.6819] RIP: 0010:btrfs_put_transaction+0x123/0x130 [btrfs] [552.6821] Code: bd a0 01 00 (...) [552.6821] RSP: 0018:ffffa168c0527e28 EFLAGS: 00010286 [552.6821] RAX: ffff936042caed00 RBX: ffff93604a3eb448 RCX: 0000000000000000 [552.6821] RDX: ffff93606421b028 RSI: ffffffff92ff0878 RDI: ffff93606421b010 [552.6821] RBP: ffff93606421b000 R08: 0000000000000000 R09: ffffa168c0d07c20 [552.6821] R10: 0000000000000000 R11: ffff93608dc52950 R12: ffffa168c0527e70 [552.6821] R13: ffff93606421b000 R14: ffff93604a3eb420 R15: ffff93606421b028 [552.6821] FS: 0000000000000000(0000) GS:ffff93675fb00000(0000) knlGS:0000000000000000 [552.6821] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [552.6821] CR2: 0000558ad262b000 CR3: 000000014feda005 CR4: 0000000000370ee0 [552.6822] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [552.6822] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [552.6822] Call Trace: [552.6822] <TASK> [552.6822] ? __warn+0x80/0x130 [552.6822] ? btrfs_put_transaction+0x123/0x130 [btrfs] [552.6824] ? report_bug+0x1f4/0x200 [552.6824] ? handle_bug+0x42/0x70 [552.6824] ? exc_invalid_op+0x14/0x70 [552.6824] ? asm_exc_invalid_op+0x16/0x20 [552.6824] ? btrfs_put_transaction+0x123/0x130 [btrfs] [552.6826] btrfs_cleanup_transaction+0xe7/0x5e0 [btrfs] [552.6828] ? _raw_spin_unlock_irqrestore+0x23/0x40 [552.6828] ? try_to_wake_up+0x94/0x5e0 [552.6828] ? __pfx_process_timeout+0x10/0x10 [552.6828] transaction_kthread+0x103/0x1d0 [btrfs] [552.6830] ? __pfx_transaction_kthread+0x10/0x10 [btrfs] [552.6832] kthread+0xee/0x120 [552.6832] ? __pfx_kthread+0x10/0x10 [552.6832] ret_from_fork+0x29/0x50 [552.6832] </TASK> [552.6832] ---[ end trace 0000000000000000 ]--- This corresponds to this line of code: void btrfs_put_transaction(struct btrfs_transaction *transaction) { (...) WARN_ON(!RB_EMPTY_ROOT( &transaction->delayed_refs.dirty_extent_root)); (...) } The warning happens because btrfs_qgroup_destroy_extent_records(), called in the transaction abort path, we free all entries from the rbtree "dirty_extent_root" with rbtree_postorder_for_each_entry_safe(), but we don't actually empty the rbtree - it's still pointing to nodes that were freed. So set the rbtree's root node to NULL to avoid this warning (assign RB_ROOT).

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 0 5.4.251
SUSE:Linux Enterprise High Availability Extension 15 SP6 kernel-default 0 6.4.0-150600.23.84.1
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-default 0 6.4.0-150600.23.84.1
SUSE:Linux Enterprise Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_19 0 1-150600.13.3.1
SUSE:Linux Enterprise Server 15 SP6-LTSS kernel-64kb 0 6.4.0-150600.23.84.1
SUSE:Linux Enterprise Server 15 SP6-LTSS kernel-default 0 6.4.0-150600.23.84.1
SUSE:Linux Enterprise Server 15 SP6-LTSS kernel-default-base 0 6.4.0-150600.23.84.1.150600.12.38.1
SUSE:Linux Enterprise Server 15 SP6-LTSS kernel-docs 0 6.4.0-150600.23.84.1
SUSE:Linux Enterprise Server 15 SP6-LTSS kernel-obs-build 0 6.4.0-150600.23.84.1
SUSE:Linux Enterprise Server 15 SP6-LTSS kernel-source 0 6.4.0-150600.23.84.1
SUSE:Linux Enterprise Server 15 SP6-LTSS kernel-syms 0 6.4.0-150600.23.84.1
SUSE:Linux Enterprise Server 15 SP6-LTSS kernel-zfcpdump 0 6.4.0-150600.23.84.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6 kernel-default 0 6.4.0-150600.23.84.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6 kernel-default-base 0 6.4.0-150600.23.84.1.150600.12.38.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6 kernel-docs 0 6.4.0-150600.23.84.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6 kernel-obs-build 0 6.4.0-150600.23.84.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6 kernel-source 0 6.4.0-150600.23.84.1
SUSE:Linux Enterprise Server for SAP Applications 15 SP6 kernel-syms 0 6.4.0-150600.23.84.1
openSUSE:Leap 15.6 dtb-aarch64 0 6.4.0-150600.23.84.1
openSUSE:Leap 15.6 kernel-64kb 0 6.4.0-150600.23.84.1
openSUSE:Leap 15.6 kernel-debug 0 6.4.0-150600.23.84.1
openSUSE:Leap 15.6 kernel-default 0 6.4.0-150600.23.84.1
openSUSE:Leap 15.6 kernel-default-base 0 6.4.0-150600.23.84.1.150600.12.38.1
openSUSE:Leap 15.6 kernel-docs 0 6.4.0-150600.23.84.1
openSUSE:Leap 15.6 kernel-kvmsmall 0 6.4.0-150600.23.84.1
openSUSE:Leap 15.6 kernel-obs-build 0 6.4.0-150600.23.84.1
openSUSE:Leap 15.6 kernel-obs-qa 0 6.4.0-150600.23.84.1
openSUSE:Leap 15.6 kernel-source 0 6.4.0-150600.23.84.1
openSUSE:Leap 15.6 kernel-syms 0 6.4.0-150600.23.84.1
openSUSE:Leap 15.6 kernel-zfcpdump 0 6.4.0-150600.23.84.1

Related vulnerabilities