CVE-2025-39759
published 2025-09-11CVE-2025-39759: In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix race between quota disable and quota rescan ioctl There's a race between…
high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
In the Linux kernel, the following vulnerability has been resolved:
btrfs: qgroup: fix race between quota disable and quota rescan ioctl
There's a race between a task disabling quotas and another running the
rescan ioctl that can result in a use-after-free of qgroup records from
the fs_info->qgroup_tree rbtree.
This happens as follows:
1) Task A enters btrfs_ioctl_quota_rescan() -> btrfs_qgroup_rescan();
2) Task B enters btrfs_quota_disable() and calls
btrfs_qgroup_wait_for_completion(), which does nothing because at that
point fs_info->qgroup_rescan_running is false (it wasn't set yet by
task A);
3) Task B calls btrfs_free_qgroup_config() which starts freeing qgroups
from fs_info->qgroup_tree without taking the lock fs_info->qgroup_lock;
4) Task A enters qgroup_rescan_zero_tracking() which starts iterating
the fs_info->qgroup_tree tree while holding fs_info->qgroup_lock,
but task B is freeing qgroup records from that tree without holding
the lock, resulting in a use-after-free.
Fix this by taking fs_info->qgroup_lock at btrfs_free_qgroup_config().
Also at btrfs_qgroup_rescan() don't start the rescan worker if quotas
were already disabled.
Affected
32 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 6.1.153-1 (bookworm) | linux 6.1.153-1 (bookworm) |
| debian | linux-6.1 | < linux 6.1.153-1 (bookworm) | linux 6.1.153-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= e685da14af6b31e4b336a110cb1bae1afc268be8 < 7cda0fdde5d9890976861421d207870500f9aace | 7cda0fdde5d9890976861421d207870500f9aace |
| linux | linux | >= e685da14af6b31e4b336a110cb1bae1afc268be8 < b172535ccba12f0cf7d23b3b840989de47fc104d | b172535ccba12f0cf7d23b3b840989de47fc104d |
| linux | linux | >= e685da14af6b31e4b336a110cb1bae1afc268be8 < dd0b28d877b293b1d7f8727a7de08ae36b6b9ef0 | dd0b28d877b293b1d7f8727a7de08ae36b6b9ef0 |
| linux | linux | >= e685da14af6b31e4b336a110cb1bae1afc268be8 < c38028ce0d0045ca600b6a8345a0ff92bfb47b66 | c38028ce0d0045ca600b6a8345a0ff92bfb47b66 |
| linux | linux | >= e685da14af6b31e4b336a110cb1bae1afc268be8 < 2fd0f5ceb997f90f4332ccbab6c7e907e6b2d0eb | 2fd0f5ceb997f90f4332ccbab6c7e907e6b2d0eb |
| linux | linux | >= e685da14af6b31e4b336a110cb1bae1afc268be8 < e1249667750399a48cafcf5945761d39fa584edf | e1249667750399a48cafcf5945761d39fa584edf |
| linux | linux_kernel | >= 0 < 6.1.153-1 | 6.1.153-1 |
| linux | linux_kernel | >= 0 < 6.12.48-1 | 6.12.48-1 |
| linux | linux_kernel | >= 0 < 6.16.3-1 | 6.16.3-1 |
| linux | linux_kernel | >= 0 < 6.8.0-100.100 | 6.8.0-100.100 |
| linux | linux_kernel | >= 3.12 < 6.1.149 | 6.1.149 |
| linux | linux_kernel | >= 6.13 < 6.15.11 | 6.15.11 |
| linux | linux_kernel | >= 6.16 < 6.16.2 | 6.16.2 |
| linux | linux_kernel | >= 6.2 < 6.6.103 | 6.6.103 |
| linux | linux_kernel | >= 6.7 < 6.12.44 | 6.12.44 |
| msrc | azl3_kernel_6.6.96.2-2_on_azure_linux_3.0 | — | — |
| msrc | cbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.200.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.202.1-1_on_cbl_mariner_2.0 | — | — |
| ubuntu | linux-aws | — | — |
| ubuntu | linux-aws-6.8 | — | — |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.0HIGH