CVE-2025-40100

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: do not assert we found block group item when creating free space tree

Currently, when building a free space tree at populate_free_space_tree(),

if we are not using the block group tree feature, we always expect to find

block group items (either extent items or a block group item with key type

BTRFS_BLOCK_GROUP_ITEM_KEY) when we search the extent tree with

btrfs_search_slot_for_read(), so we assert that we found an item. However

this expectation is wrong since we can have a new block group created in

the current transaction which is still empty and for which we still have

not added the block group's item to the extent tree, in which case we do

not have any items in the extent tree associated to the block group.

The insertion of a new block group's block group item in the extent tree

happens at btrfs_create_pending_block_groups() when it calls the helper

insert_block_group_item(). This typically is done when a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References