CVE-2025-39779

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: subpage: keep TOWRITE tag until folio is cleaned

btrfs_subpage_set_writeback() calls folio_start_writeback() the first time

a folio is written back, and it also clears the PAGECACHE_TAG_TOWRITE tag

even if there are still dirty blocks in the folio. This can break ordering

guarantees, such as those required by btrfs_wait_ordered_extents().

That ordering breakage leads to a real failure. For example, running

generic/464 on a zoned setup will hit the following ASSERT. This happens

because the broken ordering fails to flush existing dirty pages before the

file size is truncated.

assertion failed: !list_empty(&ordered->list) :: 0, in fs/btrfs/zoned.c:1899

------------[ cut here ]------------

kernel BUG at fs/btrfs/zoned.c:1899!

Oops: invalid opcode: 0000 [#1] SMP NOPTI

CPU: 2 UID: 0 PID: 1906169 Comm: kworker/u130:2 Kdump: loaded Not tainted 6.16.0-rc6-BTRFS-ZNS+ #554 PREEMPT(voluntary)

Hardware name:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References