In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix BUG_ON condition in btrfs_cancel_balance
Pausing and canceling balance can race to interrupt balance lead to BUG_ON
panic in btrfs_cancel_balance. The BUG_ON condition in btrfs_cancel_balance
does not take this race scenario into account.
However, the race condition has no other side effects. We can fix that.
Reproducing it with panic trace like this:
kernel BUG at fs/btrfs/volumes.c:4618!
RIP: 0010:btrfs_cancel_balance+0x5cf/0x6a0
Call Trace:
<TASK>
? do_nanosleep+0x60/0x120
? hrtimer_nanosleep+0xb7/0x1a0
? sched_core_clone_cookie+0x70/0x70
btrfs_ioctl_balance_ctl+0x55/0x70
btrfs_ioctl+0xa46/0xd20
__x64_sys_ioctl+0x7d/0xa0
do_syscall_64+0x38/0x80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Race scenario as follows:
> mutex_unlock(&fs_info->balance_mutex);
> --------------------
> .......issue pause and cancel req in another thread
> --------------------
> ret = __btrfs_balance(fs_info);
>
> mutex_lock(&fs_info->balance_mutex);
> if (ret == -ECANCELED && atomic_read(&fs_info->balance_pause_req)) {
> btrfs_info(fs_info, "balance: paused");
> btrfs_exclop_balance(fs_info, BTRFS_EXCLOP_BALANCE_PAUSED);
> }
References
Configurations
Configuration 1 (hide)
|
History
11 Dec 2025, 15:45
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/29eefa6d0d07e185f7bfe9576f91e6dba98189c2 - Patch | |
| References | () https://git.kernel.org/stable/c/7c93b89cd46636b5e74c12fa21dd86167bc6ea8d - Patch | |
| References | () https://git.kernel.org/stable/c/a0a462a0f20926918d6009f0b4b25673e883fc98 - Patch | |
| References | () https://git.kernel.org/stable/c/ae81329f7de3aa6f34ecdfa5412e72161a30e9ce - Patch | |
| References | () https://git.kernel.org/stable/c/b966e9e1e250dfdb41a7f41775faea4a37af923c - Patch | |
| References | () https://git.kernel.org/stable/c/bd7bef82ce0e929ef4cf63a34990545aaca28077 - Patch | |
| References | () https://git.kernel.org/stable/c/ceb9ba8e30833a4823e2dc73f80ebcdf2498d01a - Patch | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.5 |
| CPE | cpe:2.3:o:linux:linux_kernel:6.5:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.5:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.5:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.5:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.5:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.5:rc3:*:*:*:*:*:* |
|
| CWE | CWE-617 | |
| First Time |
Linux
Linux linux Kernel |
17 Sep 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-17 15:15
Updated : 2025-12-11 15:45
NVD link : CVE-2023-53339
Mitre link : CVE-2023-53339
CVE.ORG link : CVE-2023-53339
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-617
Reachable Assertion