CVE-2025-21753

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix use-after-free when attempting to join an aborted transaction

When we are trying to join the current transaction and if it's aborted,

we read its 'aborted' field after unlocking fs_info->trans_lock and

without holding any extra reference count on it. This means that a

concurrent task that is aborting the transaction may free the transaction

before we read its 'aborted' field, leading to a use-after-free.

Fix this by reading the 'aborted' field while holding fs_info->trans_lock

since any freeing task must first acquire that lock and set

fs_info->running_transaction to NULL before freeing the transaction.

This was reported by syzbot and Dmitry with the following stack traces

from KASAN:

==================================================================

BUG: KASAN: slab-use-after-free in join_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278

Read of size 4 at addr ffff888011839024 by task kworker

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References