Skip to content
Heist/ feed
High

btrfs: do not allow relocation of partially dropped subvolumes

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not allow relocation of partially dropped subvolumes [BUG] There is an internal report that balance triggered transaction abort, with the following call trace: item 85 key (594509824 169 0) itemoff 12599 itemsize 33 extent refs 1 gen 197740 flags 2 ref#0: tree block backref root 7 item 86 key (594558976 169 0) itemoff 12566 itemsize 33 extent refs 1 gen 197522 flags 2 ref#0: tree block backref root 7 ... BTRFS error (device loop0): extent item not found for insert, bytenr 594526208 num_bytes 16384 parent 449921024 root_objectid 934 owner 1 offset 0 BTRFS error (device loop0): failed to run delayed ref for logical 594526208 num_bytes 16384 type 182 action 1 ref_mod 1: -117 ------------[ cut here ]------------ BTRFS: Transaction aborted (error -117) WARNING: CPU: 1 PID: 6963 at ../fs/btrfs/extent-tree.c:2168 btrfs_run_delayed_refs+0xfa/0x110 [btrfs] And btrfs check doesn't report anything wrong related to the extent tree. [CAUSE] The cause is a little complex, firstly the extent tree indeed doesn't have the backref for 594526208. The extent tree only have the following two backrefs around that bytenr on-disk: item 65 key (594509824 METADATA_ITEM 0) itemoff 13880 itemsize 33 refs 1 gen 197740 flags TREE_BLOCK tree block skinny level 0 (176 0x7) tree block backref root CSUM_TREE item 66 key (594558976 METADATA_ITEM 0) itemoff 13847 itemsize 33 refs 1 gen 197522 flags TREE_BLOCK tree block skinny level 0

Announced Source revision 1
Original source ↗

CVE-2025-39738

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2025-39738

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "638331fa56caeaa8b4d31cc1dfbe0ce989bcff67",
        "lessThan": "fa086b1398cf7e5f7dee7241bd5f2855cb5df8dc",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "638331fa56caeaa8b4d31cc1dfbe0ce989bcff67",
        "lessThan": "fcb1f77b8ed8795608ca7a1f6505e2b07236c1f3",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "638331fa56caeaa8b4d31cc1dfbe0ce989bcff67",
        "lessThan": "f83d4c81bda3b7d1813268ab77408f7a0ce691ff",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "638331fa56caeaa8b4d31cc1dfbe0ce989bcff67",
        "lessThan": "39a93e1c9dbf7e11632efeb20fcf0fc1dcf64d51",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "638331fa56caeaa8b4d31cc1dfbe0ce989bcff67",
        "lessThan": "125e94a4b76b7b75d194f85bedd628097d2121f0",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "638331fa56caeaa8b4d31cc1dfbe0ce989bcff67",
        "lessThan": "4e403bd8e127d40dc7c05f06ee969c1ba1537ec5",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "638331fa56caeaa8b4d31cc1dfbe0ce989bcff67",
        "lessThan": "4289b494ac553e74e86fed1c66b2bf9530bc1082",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "fs/btrfs/relocation.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.11"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.11",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.15.190",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.149",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.103",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.43",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.15.11",
        "versionType": "semver",
        "lessThanOrEqual": "6.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.16.2",
        "versionType": "semver",
        "lessThanOrEqual": "6.16.*"
      },
      {
        "status": "unaffected",
        "version": "6.17",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "fs/btrfs/relocation.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2025-39738

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#30625 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement