CVE-2025-39884

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix subvolume deletion lockup caused by inodes xarray race

There is a race condition between inode eviction and inode caching that

can cause a live struct btrfs_inode to be missing from the root->inodes

xarray. Specifically, there is a window during evict() between the inode

being unhashed and deleted from the xarray. If btrfs_iget() is called

for the same inode in that window, it will be recreated and inserted

into the xarray, but then eviction will delete the new entry, leaving

nothing in the xarray:

Thread 1 Thread 2

---------------------------------------------------------------

evict()

remove_inode_hash()

btrfs_iget_path()

btrfs_iget_locked()

btrfs_read_locked_inode()

btrfs_add_inode_to_root()

destroy_inode()

btrfs_destroy_inode()

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References