CVE-2025-38269

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-38269
In the Linux kernel, the following vulnerability has been resolved: btrfs: exit after state insertion failure at btrfs_convert_extent_bit() If insert_state() state failed it returns an error pointer and we call extent_io_tree_panic() which will trigger a BUG() call. However if CONFIG_BUG is disabled, which is an uncommon and exotic scenario, then we fallthrough and call cache_state() which will dereference the error pointer, resulting in an invalid memory access. So jump to the 'out' label after calling extent_io_tree_panic(), it also makes the code more clear besides dealing with the exotic scenario where CONFIG_BUG is disabled.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/3bf179e36da917c5d9bec71c714573ed1649b7c1 Patch
https://git.kernel.org/stable/c/58c50f45e1821a04d61b62514f9bd34afe67c622 Patch
https://git.kernel.org/stable/c/8d9d32088e304e2bc444a3087cab0bbbd9951866 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

20 Nov 2025, 16:39

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux
Linux linux Kernel
References () https://git.kernel.org/stable/c/3bf179e36da917c5d9bec71c714573ed1649b7c1 - () https://git.kernel.org/stable/c/3bf179e36da917c5d9bec71c714573ed1649b7c1 - Patch
References () https://git.kernel.org/stable/c/58c50f45e1821a04d61b62514f9bd34afe67c622 - () https://git.kernel.org/stable/c/58c50f45e1821a04d61b62514f9bd34afe67c622 - Patch
References () https://git.kernel.org/stable/c/8d9d32088e304e2bc444a3087cab0bbbd9951866 - () https://git.kernel.org/stable/c/8d9d32088e304e2bc444a3087cab0bbbd9951866 - Patch
CWE CWE-476
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

10 Jul 2025, 13:17

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: salida tras fallo de inserción de estado en btrfs_convert_extent_bit(). Si el estado insert_state() falla, devuelve un puntero de error y se llama a extent_io_tree_panic(), lo que activa una llamada a BUG(). Sin embargo, si CONFIG_BUG está deshabilitado (un escenario inusual y exótico), se pasa a la siguiente etapa y se llama a cache_state(), lo que desreferencia el puntero de error, lo que resulta en un acceso no válido a memoria. Por lo tanto, al saltar a la etiqueta "out" después de llamar a extent_io_tree_panic(), se aclara el código, además de abordar el escenario exótico donde CONFIG_BUG está deshabilitado.

10 Jul 2025, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-10 08:15

Updated : 2025-11-20 16:39

NVD link : CVE-2025-38269

Mitre link : CVE-2025-38269

CVE.ORG link : CVE-2025-38269

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference