CVE-2025-38034

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: correct the order of prelim_ref arguments in btrfs__prelim_ref

btrfs_prelim_ref() calls the old and new reference variables in the

incorrect order. This causes a NULL pointer dereference because oldref

is passed as NULL to trace_btrfs_prelim_ref_insert().

Note, trace_btrfs_prelim_ref_insert() is being called with newref as

oldref (and oldref as NULL) on purpose in order to print out

the values of newref.

To reproduce:

echo 1 > /sys/kernel/debug/tracing/events/btrfs/btrfs_prelim_ref_insert/enable

Perform some writeback operations.

Backtrace:

BUG: kernel NULL pointer dereference, address: 0000000000000018

#PF: supervisor read access in kernel mode

#PF: error_code(0x0000) - not-present page

PGD 115949067 P4D 115949067 PUD 11594a067 PMD 0

Oops: Oops: 0000 [#1] SMP NOPTI

CPU: 1 UID: 0 PID: 1188 Comm: fsstress Not tainted 6.15.0-rc2-tester+ #47 PREEMPT(voluntary) 7ca2cef72d5e9c600f0c7718adb6462de8149622

H

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References