btrfs: always detect conflicting inodes when logging inode refs
In the Linux kernel, the following vulnerability has been resolved: btrfs: always detect conflicting inodes when logging inode refs After rename exchanging (either with the rename exchange operation or regular renames in multiple non-atomic steps) two inodes and at least one of them is a directory, we can end up with a log tree that contains only of the inodes and after a power failure that can result in an attempt to delete the other inode when it should not because it was not deleted before the power failure. In some case that delete attempt fails when the target inode is a directory that contains a subvolume inside it, since the log replay code is not prepared to deal with directory entries that point to root items (only inode items). 1) We have directories "dir1" (inode A) and "dir2" (inode B) under the same parent directory; 2) We have a file (inode C) under directory "dir1" (inode A); 3) We have a subvolume inside directory "dir2" (inode B); 4) All these inodes were persisted in a past transaction and we are currently at transaction N; 5) We rename the file (inode C), so at btrfs_log_new_name() we update inode C's last_unlink_trans to N; 6) We get a rename exchange for "dir1" (inode A) and "dir2" (inode B), so after the exchange "dir1" is inode B and "dir2" is inode A. During the rename exchange we call btrfs_log_new_name() for inodes A and B, but because they are directories, we don't update their last_unlink_trans to N; 7) An fsync against the file (inode C) is done,
CVE-2025-71183
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-71183
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "56f23fdbb600e6087db7b009775b95ce07cc3195",
"lessThan": "c7f0207db68d5a1b4af23acbef1a8e8ddc431ebb",
"versionType": "git"
},
{
"status": "affected",
"version": "56f23fdbb600e6087db7b009775b95ce07cc3195",
"lessThan": "a63998cd6687c14b160dccb0bbcf281b2eb0dab3",
"versionType": "git"
},
{
"status": "affected",
"version": "56f23fdbb600e6087db7b009775b95ce07cc3195",
"lessThan": "0c2413c69129f6ce60157f7b53d9ba880260400b",
"versionType": "git"
},
{
"status": "affected",
"version": "56f23fdbb600e6087db7b009775b95ce07cc3195",
"lessThan": "d52af58dd463821c5c516aebb031a58934f696ea",
"versionType": "git"
},
{
"status": "affected",
"version": "56f23fdbb600e6087db7b009775b95ce07cc3195",
"lessThan": "7ba0b6461bc4edb3005ea6e00cdae189bcf908a5",
"versionType": "git"
},
{
"status": "affected",
"version": "048605483fbdd1e77ead32a7cd7b95cc17eaaf0e",
"versionType": "git"
},
{
"status": "affected",
"version": "033ad030df0ea932a21499582fea59e1df95769b",
"versionType": "git"
},
{
"status": "affected",
"version": "1653a3b0e9436c10eb307c318776cf91fe18ff08",
"versionType": "git"
},
{
"status": "affected",
"version": "ff440e9185e96cbb94481fc8b6192b944dcfc061",
"versionType": "git"
},
{
"status": "affected",
"version": "3.18.32",
"lessThan": "3.19",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.1.23",
"lessThan": "4.2",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.4.8",
"lessThan": "4.5",
"versionType": "semver"
},
{
"status": "affected",
"version": "4.5.2",
"lessThan": "4.6",
"versionType": "semver"
}
],
"programFiles": [
"fs/btrfs/tree-log.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.6",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.161",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.121",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.66",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.6",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/btrfs/tree-log.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2025-71183
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #39175 · Revision 1
- Added to Heist Feed
- Publisher date