CVE-2025-37856

In the Linux kernel, the following vulnerability has been resolved:

btrfs: harden block_group::bg_list against list_del() races

As far as I can tell, these calls of list_del_init() on bg_list cannot

run concurrently with btrfs_mark_bg_unused() or btrfs_mark_bg_to_reclaim(),

as they are in transaction error paths and situations where the block

group is readonly.

However, if there is any chance at all of racing with mark_bg_unused(),

or a different future user of bg_list, better to be safe than sorry.

Otherwise we risk the following interleaving (bg_list refcount in parens)

T1 (some random op) T2 (btrfs_mark_bg_unused)

!list_empty(&bg->bg_list); (1)

list_del_init(&bg->bg_list); (1)

list_move_tail (1)

btrfs_put_block_group (0)

btrfs_delete_unused_bgs

bg = list_first_entry

list_del_init(&bg->bg_list);

btrfs_put_block_group(bg); (-1)

Ultimately, this results in a broken ref count that hits zero one deref

early and the real final deref underflows the refcount, resulting in a WARNING.