CVE-2025-40303

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: ensure no dirty metadata is written back for an fs with errors

[BUG]

During development of a minor feature (make sure all btrfs_bio::end_io()

is called in task context), I noticed a crash in generic/388, where

metadata writes triggered new works after btrfs_stop_all_workers().

It turns out that it can even happen without any code modification, just

using RAID5 for metadata and the same workload from generic/388 is going

to trigger the use-after-free.

[CAUSE]

If btrfs hits an error, the fs is marked as error, no new

transaction is allowed thus metadata is in a frozen state.

But there are some metadata modifications before that error, and they are

still in the btree inode page cache.

Since there will be no real transaction commit, all those dirty folios

are just kept as is in the page cache, and they can not be invalidated

by invalidate_inode_pages2() call inside close_ctree(), because they are

dirty.

And f

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References