CVE-2025-39759

What it actually does

Race condition between btrfs_quota_disable() and btrfs_ioctl_quota_rescan() allows concurrent access to the qgroup_tree rbtree without proper locking, resulting in use-after-free of qgroup records.

Why it matters to the business

Local attackers on affected Linux systems can trigger kernel memory corruption, leading to crashes, denial of service, or potential privilege escalation; high ecosystem prevalence increases exposure for servers and containers using btrfs.

How an attack unfolds

An attacker with local access issues concurrent quota rescan and quota disable operations; one path starts the rescan worker while the other frees qgroup structures without holding qgroup_lock, causing the rescan iterator to dereference freed memory. Threat actor mentions such as VMSCAPE highlight similar kernel race patterns used in container escapes.

How to fix it

Upgrade the Linux kernel to the fixed commit 7cda0fdde5d9890976861421d207870500f9aace or later stable releases containing the patch that acquires qgroup_lock in btrfs_free_qgroup_config() and checks quota state before starting rescan.

How to confirm the fix worked

Verify kernel source or binary contains commit 7cda0fdde5d9890976861421d207870500f9aace; confirm btrfs quota disable and rescan operations no longer race by reviewing qgroup_lock usage and testing concurrent ioctl sequences.

Typical attack path

1. Obtain local user access on a btrfs filesystem with quotas enabled
2. Issue quota rescan ioctl from one task while triggering quota disable from another
3. Exploit the window where qgroup_rescan_running is not yet set and qgroup_lock is not held during free
4. Trigger use-after-free during qgroup_tree iteration leading to memory corruption or crash

How to detect it

Review kernel logs for use-after-free warnings or oops involving qgroup_tree, btrfs_qgroup, or quota rescan paths; correlate with audit logs showing concurrent quota ioctl calls from the same or different processes.

What your security team should do

• Apply the referenced kernel commit or distribution update containing the fix as soon as packages are available
• Restrict untrusted local access to systems using btrfs with quotas until patched
• Monitor for kernel oops or panic reports involving qgroup_tree or btrfs_qgroup