CVE-2025-39759

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: qgroup: fix race between quota disable and quota rescan ioctl

There's a race between a task disabling quotas and another running the

rescan ioctl that can result in a use-after-free of qgroup records from

the fs_info->qgroup_tree rbtree.

This happens as follows:

1) Task A enters btrfs_ioctl_quota_rescan() -> btrfs_qgroup_rescan();

2) Task B enters btrfs_quota_disable() and calls

btrfs_qgroup_wait_for_completion(), which does nothing because at that

point fs_info->qgroup_rescan_running is false (it wasn't set yet by

task A);

3) Task B calls btrfs_free_qgroup_config() which starts freeing qgroups

from fs_info->qgroup_tree without taking the lock fs_info->qgroup_lock;

4) Task A enters qgroup_rescan_zero_tracking() which starts iterating

the fs_info->qgroup_tree tree while holding fs_info->qgroup_lock,

but task B is freeing qgroup records from that tree without holding

the lock, resulting

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References