CVE-2025-21879: btrfs: fix use-after-free on inode when scanning root during em shrinking

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-27 · updated 2026-06-17
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free on inode when scanning root during em shrinking At btrfs_scan_root() we are accessing the inode's root (and fs_info) in a call to btrfs_fs_closing() after we have scheduled the inode for a delayed iput, and that can result in a use-after-free on the inode in case the cleaner kthread does the iput before we dereference the inode in the call to btrfs_fs_closing(). Fix this by using the fs_info stored already in a local variable instead of doing inode->root->fs_info.

Affected products

Linux kernel: from 6.13 before 6.13.6; 6.14-rc1, 6.14-rc2, 6.14-rc3, 6.14-rc4 — fixed in 6.13.6

How to fix

Upgrade to a fixed version: Linux kernel 6.13.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-21879 or the next vulnerability affects your stack