CVE-2025-21754

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix assertion failure when splitting ordered extent after transaction abort

If while we are doing a direct IO write a transaction abort happens, we

mark all existing ordered extents with the BTRFS_ORDERED_IOERR flag (done

at btrfs_destroy_ordered_extents()), and then after that if we enter

btrfs_split_ordered_extent() and the ordered extent has bytes left

(meaning we have a bio that doesn't cover the whole ordered extent, see

details at btrfs_extract_ordered_extent()), we will fail on the following

assertion at btrfs_split_ordered_extent():

ASSERT(!(flags & ~BTRFS_ORDERED_TYPE_FLAGS));

because the BTRFS_ORDERED_IOERR flag is set and the definition of

BTRFS_ORDERED_TYPE_FLAGS is just the union of all flags that identify the

type of write (regular, nocow, prealloc, compressed, direct IO, encoded).

Fix this by returning an error from btrfs_extract_ordered_extent() if we

find the BTRFS_ORDERED_IOERR flag in

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References