cbcvebase.
CVE-2025-38034
published 2025-06-18

CVE-2025-38034: In the Linux kernel, the following vulnerability has been resolved: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref btrfs_prelim_ref()…

medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
In the Linux kernel, the following vulnerability has been resolved: btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref btrfs_prelim_ref() calls the old and new reference variables in the incorrect order. This causes a NULL pointer dereference because oldref is passed as NULL to trace_btrfs_prelim_ref_insert(). Note, trace_btrfs_prelim_ref_insert() is being called with newref as oldref (and oldref as NULL) on purpose in order to print out the values of newref. To reproduce: echo 1 > /sys/kernel/debug/tracing/events/btrfs/btrfs_prelim_ref_insert/enable Perform some writeback operations. Backtrace: BUG: kernel NULL pointer dereference, address: 0000000000000018 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 115949067 P4D 115949067 PUD 11594a067 PMD 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 1 UID: 0 PID: 1188 Comm: fsstress Not tainted 6.15.0-rc2-tester+ #47 PREEMPT(voluntary) 7ca2cef72d5e9c600f0c7718adb6462de8149622 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-2-gc13ff2cd-prebuilt.qemu.org 04/01/2014 RIP: 0010:trace_event_raw_event_btrfs__prelim_ref+0x72/0x130 Code: e8 43 81 9f ff 48 85 c0 74 78 4d 85 e4 0f 84 8f 00 00 00 49 8b 94 24 c0 06 00 00 48 8b 0a 48 89 48 08 48 8b 52 08 48 89 50 10 8b 55 18 48 89 50 18 49 8b 55 20 48 89 50 20 41 0f b6 55 28 88 RSP: 0018:ffffce44820077a0 EFLAGS: 00010286 RAX: ffff8c6b403f9014 RBX: ffff8c6b55825730 RCX: 304994edf9cf506b RDX: d8b11eb7f0fdb699 RSI: ffff8c6b403f9010 RDI: ffff8c6b403f9010 RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000010 R10: 00000000ffffffff R11: 0000000000000000 R12: ffff8c6b4e8fb000 R13: 0000000000000000 R14: ffffce44820077a8 R15: ffff8c6b4abd1540 FS: 00007f4dc6813740(0000) GS:ffff8c6c1d378000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000018 CR3: 000000010eb42000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: prelim_ref_insert+0x1c1/0x270 find_parent_nodes+0x

Affected

37 ranges· showing 25
VendorProductVersion rangeFixed in
debiandebian_linux
debianlinux< linux 6.1.147-1 (bookworm)linux 6.1.147-1 (bookworm)
debianlinux-6.1< linux 6.1.147-1 (bookworm)linux 6.1.147-1 (bookworm)
linuxlinux
linuxlinux>= 00142756e1f8015d2f8ce96532d156689db7e448 < 5755b6731655e248c4f1d52a2e1b18795b4a2a3a5755b6731655e248c4f1d52a2e1b18795b4a2a3a
linuxlinux>= 00142756e1f8015d2f8ce96532d156689db7e448 < a641154cedf9d69730f8af5d0a901fe86e6486bda641154cedf9d69730f8af5d0a901fe86e6486bd
linuxlinux>= 00142756e1f8015d2f8ce96532d156689db7e448 < a876703894a6dd6e8c04b0635d86e9f7a7c81b79a876703894a6dd6e8c04b0635d86e9f7a7c81b79
linuxlinux>= 00142756e1f8015d2f8ce96532d156689db7e448 < 0528bba48dce7820d2da72e1a114e1c4552367eb0528bba48dce7820d2da72e1a114e1c4552367eb
linuxlinux>= 00142756e1f8015d2f8ce96532d156689db7e448 < 7a97f961a568a8f72472dc804af02a0f73152c5f7a97f961a568a8f72472dc804af02a0f73152c5f
linuxlinux>= 00142756e1f8015d2f8ce96532d156689db7e448 < 7f7c8c03feba5f2454792fab3bb8bd45bd6883f97f7c8c03feba5f2454792fab3bb8bd45bd6883f9
linuxlinux>= 00142756e1f8015d2f8ce96532d156689db7e448 < 137bfa08c6441f324d00692d1e9d22cfd773329b137bfa08c6441f324d00692d1e9d22cfd773329b
linuxlinux>= 00142756e1f8015d2f8ce96532d156689db7e448 < bc7e0975093567f51be8e1bdf4aa5900a3cf0b1ebc7e0975093567f51be8e1bdf4aa5900a3cf0b1e
linuxlinux_kernel< 5.4.2945.4.294
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.244-15.10.244-1
linuxlinux_kernel>= 0 < 6.1.147-16.1.147-1
linuxlinux_kernel>= 0 < 6.12.32-16.12.32-1
linuxlinux_kernel>= 0 < 6.12.32-16.12.32-1
linuxlinux_kernel>= 0 < 5.15.0-152.1625.15.0-152.162
linuxlinux_kernel>= 0 < 6.8.0-100.1006.8.0-100.100
linuxlinux_kernel>= 5.11 < 5.15.1855.15.185
linuxlinux_kernel>= 5.16 < 6.1.1416.1.141
linuxlinux_kernel>= 5.5 < 5.10.2385.10.238
linuxlinux_kernel>= 6.13 < 6.14.96.14.9
linuxlinux_kernel>= 6.2 < 6.6.936.6.93

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
CVE-2025-38034 — NULL Pointer Dereference in Linux | cvebase