CVE-2025-38034

What it actually does

Incorrect argument order to btrfs__prelim_ref causes trace_btrfs_prelim_ref_insert to receive NULL as oldref, resulting in kernel NULL pointer dereference during btrfs prelim ref insertion on writeback when the btrfs_prelim_ref_insert trace event is enabled.

Why it matters to the business

Kernel crashes on affected Linux systems during normal filesystem operations when tracing is active, leading to denial of service, potential data loss on uncommitted writes, and operational disruption; high prevalence in Linux distributions and downstream packages increases exposure across servers and desktops.

How an attack unfolds

An attacker with local access enables the btrfs_prelim_ref_insert tracepoint, triggers writeback operations via filesystem activity, and causes the kernel to dereference a NULL pointer in the trace event handler, resulting in an oops and system instability. Threat actor mentions of related Linux kernel privilege escalation campaigns indicate possible chaining with other btrfs or kernel flaws for broader impact.

How to fix it

Update the Linux kernel to the fixed commit 5755b6731655e248c4f1d52a2e1b18795b4a2a3a or later stable releases that correct the argument order in btrfs__prelim_ref; apply distribution-specific updates such as subversion 1.8.15-1.mga5 for Mageia; disable the trace event as a temporary mitigation if patching is delayed.

How to confirm the fix worked

Confirm the running kernel contains commit 5755b6731655e248c4f1d52a2e1b18795b4a2a3a or equivalent; attempt reproduction steps with tracing enabled and verify absence of NULL dereference oops; inspect kernel logs for resolved trace event handling.

Typical attack path

1. Obtain local access to a system running an affected Linux kernel with btrfs
2. Enable the btrfs_prelim_ref_insert trace event via debugfs
3. Perform writeback or fiemap operations that invoke prelim_ref_insert
4. Trigger NULL pointer dereference in trace_event_raw_event_btrfs__prelim_ref
5. Cause kernel oops and potential crash or instability

How to detect it

Review kernel logs for Oops messages referencing trace_event_raw_event_btrfs__prelim_ref or btrfs_prelim_ref_insert with NULL pointer dereference at address 0000000000000018; search dmesg and syslog for fsstress or btrfs_fiemap call traces; check if the btrfs_prelim_ref_insert trace event was enabled in debugfs.

• BUG: kernel NULL pointer dereference, address: 0000000000000018
• RIP: trace_event_raw_event_btrfs__prelim_ref
• prelim_ref_insert+0x1c1/0x270
• btrfs_is_data_extent_shared+0x167/0x640
• extent_fiemap+0xa5c/0xbc0

What your security team should do

• Prioritize kernel upgrades to the fixed commit across all btrfs-using systems due to 496 days since publication and ongoing threat actor interest in Linux kernel flaws
• Monitor EPSS trend and apply patches before enabling any btrfs tracepoints in production
• Audit systems for enabled debugfs tracing and restrict access to debugfs
• Test patched kernels with fsstress and fiemap workloads before broad deployment