CVE-2025-22115

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix block group refcount race in btrfs_create_pending_block_groups()

Block group creation is done in two phases, which results in a slightly

unintuitive property: a block group can be allocated/deallocated from

after btrfs_make_block_group() adds it to the space_info with

btrfs_add_bg_to_space_info(), but before creation is completely completed

in btrfs_create_pending_block_groups(). As a result, it is possible for a

block group to go unused and have 'btrfs_mark_bg_unused' called on it

concurrently with 'btrfs_create_pending_block_groups'. This causes a

number of issues, which were fixed with the block group flag

'BLOCK_GROUP_FLAG_NEW'.

However, this fix is not quite complete. Since it does not use the

unused_bg_lock, it is possible for the following race to occur:

btrfs_create_pending_block_groups btrfs_mark_bg_unused

if list_empty // false

list_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References