CVE-2025-37856

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: harden block_group::bg_list against list_del() races

As far as I can tell, these calls of list_del_init() on bg_list cannot

run concurrently with btrfs_mark_bg_unused() or btrfs_mark_bg_to_reclaim(),

as they are in transaction error paths and situations where the block

group is readonly.

However, if there is any chance at all of racing with mark_bg_unused(),

or a different future user of bg_list, better to be safe than sorry.

Otherwise we risk the following interleaving (bg_list refcount in parens)

T1 (some random op) T2 (btrfs_mark_bg_unused)

!list_empty(&bg->bg_list); (1)

list_del_init(&bg->bg_list); (1)

list_move_tail (1)

btrfs_put_block_group (0)

btrfs_delete_unused_bgs

bg = list_first_entry

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References