Cloudanix VulnDB

CVE-2025-38269

None

CVSS

—

EPSS

0.2%

Published

Jul 10, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A rare coding mistake in Linux storage handling could let memory errors occur on unusual system setups, potentially causing crashes until fixed by updates.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Failure to exit after extent_io_tree_panic() in btrfs_convert_extent_bit() allows dereference of an error pointer from insert_state() when CONFIG_BUG is disabled, resulting in invalid memory access and potential memory corruption.

Why it matters to the business

On systems with exotic kernel configurations where CONFIG_BUG is disabled, btrfs operations may trigger kernel instability or crashes; widespread Linux kernel deployments increase exposure risk until patched, though real-world impact remains low due to the uncommon scenario.

How an attack unfolds

An attacker would need to trigger a state insertion failure during btrfs extent bit conversion operations on an affected kernel build with CONFIG_BUG disabled, allowing fallthrough to cache_state() that dereferences the error pointer; no public exploits or threat actors are known.

How to fix it

Upgrade affected Linux kernel packages to fixed versions: linux-lts (Alpaquita:stream) to 6.6.58-r0, linux-lts (Alpaquita:23) to 6.1.62-r0, or apply commit 58c50f45e1821a04d61b62514f9bd34afe67c622 from stable GIT trees; rebuild kernels with CONFIG_BUG enabled where possible.

How to confirm the fix worked

Verify running kernel version against fixed releases or confirm presence of the patch in btrfs/extent_io.c; test btrfs operations under simulated insert_state failure conditions on patched builds.

Typical attack path

  1. Identify or create a btrfs filesystem on a vulnerable kernel
  2. Perform I/O or extent operations that cause insert_state() to fail and return an error pointer
  3. Trigger extent_io_tree_panic() which does not halt execution when CONFIG_BUG disabled
  4. Execute cache_state() on the invalid error pointer leading to memory access violation

How to detect it

Review kernel logs for btrfs extent_io_tree_panic messages or unexpected BUG fallthrough behavior; no widespread exploitation indicators exist given the low EPSS and lack of KEV listing.

What your security team should do

  • Apply kernel updates to fixed versions immediately on all systems using btrfs
  • Audit kernel build configurations to ensure CONFIG_BUG is enabled
  • Monitor EPSS trend for any increase in exploit likelihood
  • Prioritize patching for high-value or internet-facing systems first

The record

In the Linux kernel, the following vulnerability has been resolved: btrfs: exit after state insertion failure at btrfs_convert_extent_bit() If insert_state() state failed it returns an error pointer and we call extent_io_tree_panic() which will trigger a BUG() call. However if CONFIG_BUG is disabled, which is an uncommon and exotic scenario, then we fallthrough and call cache_state() which will dereference the error pointer, resulting in an invalid memory access. So jump to the 'out' label after calling extent_io_tree_panic(), it also makes the code more clear besides dealing with the exotic scenario where CONFIG_BUG is disabled.

Affected packages

Ecosystem Package Introduced Fixed
Debian:11 linux 0 No fix
Debian:12 linux 0 No fix
Debian:13 linux 0 6.12.35-1
Linux Kernel 0 6.12.34
Linux Kernel 6.7.0 6.12.34

Related vulnerabilities