CVE-2025-38269

btrfs: exit after state insertion failure at btrfs_convert_extent_bit()

published July 10, 2025

CVSS
—
EPSS
0%
Percentile
7.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

btrfs: exit after state insertion failure at btrfs_convert_extent_bit()

If insert_state() state failed it returns an error pointer and we call

extent_io_tree_panic() which will trigger a BUG() call. However if

CONFIG_BUG is disabled, which is an uncommon and exotic scenario, then

we fallthrough and call cache_state() which will dereference the error

pointer, resulting in an invalid memory access.

So jump to the 'out' label after calling extent_io_tree_panic(), it also

makes the code more clear besides dealing with the exotic scenario where

CONFIG_BUG is disabled.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00187 · 7.8th percentile
Published
2025-07-10T07:41Z
EPSS history
Timeline
  • 10 JUL 07:41Z
    btrfs: exit after state insertion failure at btrfs_convert_extent_bit()
    cvelistv5