Cloudanix VulnDB

CVE-2025-68359

None

CVSS

—

EPSS

0.6%

Published

Dec 24, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's handling of certain filesystem records could let attackers crash the system or gain higher privileges on affected machines.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Double free of a qgroup record object in the btrfs filesystem's delayed reference handling code, caused by shared ownership of the kfree responsibility between caller and callee in add_delayed_ref_head.

Why it matters to the business

Systems using the btrfs filesystem may experience kernel instability or crashes, potentially leading to denial of service; high ecosystem prevalence in Linux increases exposure for servers and containers.

How an attack unfolds

An attacker with local access triggers a failure in add_delayed_ref_head after btrfs_qgroup_trace_extent_nolock reports an existing record, causing the caller to free already-freed memory, leading to memory corruption exploitable for privilege escalation or DoS.

How to fix it

Upgrade the Linux kernel to a version containing commit 7617680769e3119dfb3b43a2b7c287ce2242211c or apply the equivalent patch for btrfs delayed ref handling. For affected Chainguard images, update to version 2.9.5-r14 or later.

How to confirm the fix worked

Verify the presence of the fix commit in the kernel source or check running kernel version against fixed releases; test btrfs operations involving qgroups.

Typical attack path

  1. Trigger btrfs qgroup tracing with extent that already exists
  2. Induce error in add_delayed_ref_head
  3. Allow caller to perform second kfree on the record

How to detect it

Look for kernel logs showing double free errors or oops in btrfs_qgroup or delayed_ref functions; monitor for unexpected memory corruption crashes in btrfs workloads.

What your security team should do

  • Prioritize patching Linux kernels with btrfs qgroup support
  • Monitor for kernel oops or panics related to btrfs
  • Restrict unprivileged access to btrfs filesystems if patching delayed

The record

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free of qgroup record after failure to add delayed ref head In the previous code it was possible to incur into a double kfree() scenario when calling add_delayed_ref_head(). This could happen if the record was reported to already exist in the btrfs_qgroup_trace_extent_nolock() call, but then there was an error later on add_delayed_ref_head(). In this case, since add_delayed_ref_head() returned an error, the caller went to free the record. Since add_delayed_ref_head() couldn't set this kfree'd pointer to NULL, then kfree() would have acted on a non-NULL 'record' object which was pointing to memory already freed by the callee. The problem comes from the fact that the responsibility to kfree the object is on both the caller and the callee at the same time. Hence, the fix for this is to shift the ownership of the 'qrecord' object out of the add_delayed_ref_head(). That is, we will never attempt to kfree() the given object inside of this function, and will expect the caller to act on the 'qrecord' object on its own. The only exception where the 'qrecord' object cannot be kfree'd is if it was inserted into the tracing logic, for which we already have the 'qrecord_inserted_ret' boolean to account for this. Hence, the caller has to kfree the object only if add_delayed_ref_head() reports not to have inserted it on the tracing logic. As a side-effect of the above, we must guarantee that 'qrecord_inserted_ret' is properly initialized at the start of the function, not at the end, and then set when an actual insert happens. This way we avoid 'qrecord_inserted_ret' having an invalid value on an early exit. The documentation from the add_delayed_ref_head() has also been updated to reflect on the exact ownership of the 'qrecord' object.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 6.12.0 6.17.13
openSUSE:Leap 16.0 dtb-aarch64 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-64kb 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-azure 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-default 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-default-base 0 6.12.0-160000.26.1.160000.2.7
openSUSE:Leap 16.0 kernel-docs 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-kvmsmall 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-obs-build 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-obs-qa 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-rt 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-source 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-syms 0 6.12.0-160000.26.1
openSUSE:Leap 16.0 kernel-zfcpdump 0 6.12.0-160000.26.1
openSUSE:Tumbleweed kernel-source 0 6.18.5-1.1
openSUSE:Tumbleweed kernel-source-longterm 0 6.18.16-1.1

Related vulnerabilities