CVE-2025-68359

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix double free of qgroup record after failure to add delayed ref head

In the previous code it was possible to incur into a double kfree()

scenario when calling add_delayed_ref_head(). This could happen if the

record was reported to already exist in the

btrfs_qgroup_trace_extent_nolock() call, but then there was an error

later on add_delayed_ref_head(). In this case, since

add_delayed_ref_head() returned an error, the caller went to free the

record. Since add_delayed_ref_head() couldn't set this kfree'd pointer

to NULL, then kfree() would have acted on a non-NULL 'record' object

which was pointing to memory already freed by the callee.

The problem comes from the fact that the responsibility to kfree the

object is on both the caller and the callee at the same time. Hence, the

fix for this is to shift the ownership of the 'qrecord' object out of

the add_delayed_ref_head(). That is, we will never attempt to kfre

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References