CVE-2025-39884

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix subvolume deletion lockup caused by inodes xarray race

There is a race condition between inode eviction and inode caching that can cause a live struct btrfsinode to be missing from the root->inodes xarray. Specifically, there is a window during evict() between the inode being unhashed and deleted from the xarray. If btrfsiget() is called for the same inode in that window, it will be recreated and inserted into the xarray, but then eviction will delete the new entry, leaving nothing in the xarray:

Thread 1 Thread 2

evict() removeinodehash() btrfsigetpath() btrfsigetlocked() btrfsreadlockedinode() btrfsaddinodetoroot() destroyinode() btrfsdestroyinode() btrfsdelinodefromroot() _xaerase

In turn, this can cause issues for subvolume deletion. Specifically, if an inode is in this lost state, and all other inodes are evicted, then btrfsdelinodefromroot() will call btrfsadddeadroot() prematurely. If the lost inode has a delayednode attached to it, then when btrfscleanonedeletedsnapshot() calls btrfskillalldelayednodes(), it will loop forever because the delayed_nodes xarray will never become empty (unless memory pressure forces the inode out). We saw this manifest as soft lockups in production.

Fix it by only deleting the xarray entry if it matches the given inode (using _xacmpxchg()).