CVE-2025-38059
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-38059
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38059.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-38059
- Downstream
- Related
- Published
- 2025-06-18T09:33:38Z
- Modified
- 2025-10-22T12:49:27.161797Z
- Summary
- btrfs: avoid NULL pointer dereference if no valid csum tree
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
btrfs: avoid NULL pointer dereference if no valid csum tree
[BUG] When trying read-only scrub on a btrfs with rescue=idatacsums mount option, it will crash with the following call trace:
BUG: kernel NULL pointer dereference, address: 0000000000000208 #PF: supervisor read access in kernel mode #PF: errorcode(0x0000) - not-present page CPU: 1 UID: 0 PID: 835 Comm: btrfs Tainted: G O 6.15.0-rc3-custom+ #236 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:btrfslookupcsumsbitmap+0x49/0x480 [btrfs] Call Trace: <TASK> scrubfindfillfirststripe+0x35b/0x3d0 [btrfs] scrubsimplemirror+0x175/0x290 [btrfs] scrubstripe+0x5f7/0x6f0 [btrfs] scrubchunk+0x9a/0x150 [btrfs] scrubenumeratechunks+0x333/0x660 [btrfs] btrfsscrubdev+0x23e/0x600 [btrfs] btrfsioctl+0x1dcf/0x2f80 [btrfs] _x64sysioctl+0x97/0xc0 dosyscall64+0x4f/0x120 entrySYSCALL64afterhwframe+0x76/0x7e
[CAUSE] Mount option "rescue=idatacsums" will completely skip loading the csum tree, so that any data read will not find any data csum thus we will ignore data checksum verification.
Normally call sites utilizing csum tree will check the fs state flag NODATACSUMS bit, but unfortunately scrub does not check that bit at all.
This results in scrub to call btrfssearchslot() on a NULL pointer and triggered above crash.
[FIX] Check both extent and csum tree root before doing any tree search.
- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/50d0de59f66cbe6d597481e099bf1c70fd07e0a9
- https://git.kernel.org/stable/c/6e9770de024964b1017f99ee94f71967bd6edaeb
- https://git.kernel.org/stable/c/d35bed14b0bc95c6845863a3744ecd10b888c830
- https://git.kernel.org/stable/c/f95d186255b319c48a365d47b69bd997fecb674e
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced74ef00185eb864252156022ff129b01549504175Fixed50d0de59f66cbe6d597481e099bf1c70fd07e0a9
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced74ef00185eb864252156022ff129b01549504175Fixed6e9770de024964b1017f99ee94f71967bd6edaeb
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced74ef00185eb864252156022ff129b01549504175Fixedd35bed14b0bc95c6845863a3744ecd10b888c830
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced74ef00185eb864252156022ff129b01549504175Fixedf95d186255b319c48a365d47b69bd997fecb674e