cbcvebase.
CVE-2025-40100
published 2025-10-30

CVE-2025-40100: In the Linux kernel, the following vulnerability has been resolved: btrfs: do not assert we found block group item when creating free space tree Currently…

PriorityP421high7.8
EPSS
0.19%
8.5th percentile
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not assert we found block group item when creating free space tree Currently, when building a free space tree at populate_free_space_tree(), if we are not using the block group tree feature, we always expect to find block group items (either extent items or a block group item with key type BTRFS_BLOCK_GROUP_ITEM_KEY) when we search the extent tree with btrfs_search_slot_for_read(), so we assert that we found an item. However this expectation is wrong since we can have a new block group created in the current transaction which is still empty and for which we still have not added the block group's item to the extent tree, in which case we do not have any items in the extent tree associated to the block group. The insertion of a new block group's block group item in the extent tree happens at btrfs_create_pending_block_groups() when it calls the helper insert_block_group_item(). This typically is done when a transaction handle is released, committed or when running delayed refs (either as part of a transaction commit or when serving tickets for space reservation if we are low on free space). So remove the assertion at populate_free_space_tree() even when the block group tree feature is not enabled and update the comment to mention this case. Syzbot reported this with the following stack trace: BTRFS info (device loop3 state M): rebuilding free space tree assertion failed: ret == 0 :: 0, in fs/btrfs/free-space-tree.c:1115 ------------[ cut here ]------------ kernel BUG at fs/btrfs/free-space-tree.c:1115! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 6352 Comm: syz.3.25 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:populate_free_space_tree+0x700/0x710 fs/btrfs/free-space-tree.c:1115 Code: ff ff e8 d3 (...) RSP: 0018:ffffc9000430f780 EFLAGS: 00010246 RAX: 0000000000000043 RBX: ff

Affected

22 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.1.158-1 (bookworm)linux 6.1.158-1 (bookworm)
debianlinux-6.1< linux 6.1.158-1 (bookworm)linux 6.1.158-1 (bookworm)
linuxlinux
linuxlinux>= a5ed91828518ab076209266c2bc510adabd078df < 4f4b9ca73f84130d9fbb0fc02306ce94ce8bdbe64f4b9ca73f84130d9fbb0fc02306ce94ce8bdbe6
linuxlinux>= a5ed91828518ab076209266c2bc510adabd078df < 289498da343b05c886f19b4269429606f86dd17b289498da343b05c886f19b4269429606f86dd17b
linuxlinux>= a5ed91828518ab076209266c2bc510adabd078df < 3fdcfd91b93f930d87843156c7c8cc5fbcf9b1443fdcfd91b93f930d87843156c7c8cc5fbcf9b144
linuxlinux>= a5ed91828518ab076209266c2bc510adabd078df < eb145463f22d7d32d426b29fe9810de9e792b6baeb145463f22d7d32d426b29fe9810de9e792b6ba
linuxlinux>= a5ed91828518ab076209266c2bc510adabd078df < a5a51bf4e9b7354ce7cd697e610d72c1b33fd949a5a51bf4e9b7354ce7cd697e610d72c1b33fd949
linuxlinux_kernel>= 0 < 6.1.158-16.1.158-1
linuxlinux_kernel>= 0 < 6.12.57-16.12.57-1
linuxlinux_kernel>= 0 < 6.17.6-16.17.6-1
linuxlinux_kernel>= 0 < 6.8.0-106.1066.8.0-106.106
linuxlinux_kernel>= 0 < 6.17.0-14.146.17.0-14.14
linuxlinux_kernel>= 4.5.0 < 6.1.1586.1.158
linuxlinux_kernel>= 6.13.0 < 6.17.56.17.5
linuxlinux_kernel>= 6.2.0 < 6.6.1146.6.114
linuxlinux_kernel>= 6.7.0 < 6.12.556.12.55
msrcazl3_kernel_6.6.104.2-4_on_azure_linux_3.0
msrcazl3_kernel_6.6.112.1-2_on_azure_linux_3.0
ubuntulinux-aws
ubuntulinux-oracle
ubuntulinux-xilinx

CVSS provenance

vendor_ubuntu7.8HIGH
osv3.2LOW
vendor_msrc5.5MEDIUM
vendor_redhat5.5LOW
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.