Skip to content
Fencer Vulns
no cvss —

CVE-2025-40235 json

btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots()

published 2025-12-04 11 mo ago modified 2026-10-19 20 d ago also EUVD-2025-201224

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 11%
public exploits
0
none known

Summary

In the Linux kernel, the following vulnerability has been resolved:

btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots()

If fs_info->super_copy or fs_info->super_for_commit allocated failed in btrfs_get_tree_subvol(), then no need to call btrfs_free_fs_info(). Otherwise btrfs_check_leaked_roots() would access NULL pointer because fs_info->allocated_roots had not been initialised.

syzkaller reported the following information: ------------[ cut here ]------------ BUG: unable to handle page fault for address: fffffffffffffbb0 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 64c9067 P4D 64c9067 PUD 64cb067 PMD 0 Oops: Oops: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 1402 Comm: syz.1.35 Not tainted 6.15.8 #4 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), (...) RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline] RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline] RIP: 0010:atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline] RIP: 0010:refcount_read include/linux/refcount.h:170 [inline] RIP: 0010:btrfs_check_leaked_roots+0x18f/0x2c0 fs/btrfs/disk-io.c:1230 [...] Call Trace: <TASK> btrfs_free_fs_info+0x310/0x410 fs/btrfs/disk-io.c:1280 btrfs_get_tree_subvol+0x592/0x6b0 fs/btrfs/super.c:2029 btrfs_get_tree+0x63/0x80 fs/btrfs/super.c:2097 vfs_get_tree+0x98/0x320 fs/super.c:1759 do_new_mount+0x357/0x660 fs/namespace.c:3899 path_mount+0x716/0x19c0 fs/namespace.c:4226 do_mount fs/namespace.c:4239 [inline] __do_sys_mount fs/namespace.c:4450 [inline] __se_sys_mount fs/namespace.c:4427 [inline] __x64_sys_mount+0x28c/0x310 fs/namespace.c:4427 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x92/0x180 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f032eaffa8d [...]

Patch / fix

  • Linux Linux 6.12.56, 6.17.6, 6.18
  • linux Debian 13 6.12.57-1
  • linux Debian 14 6.17.6-1

debian advisories DEBIAN-CVE-2025-40235

  • linux Ubuntu 24.04 LTS 6.8.0-106.106
  • linux Ubuntu 25.10 6.17.0-14.14
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1050.53
  • linux-aws Ubuntu 25.10 6.17.0-1007.7
  • linux-gcp Ubuntu 24.04 LTS 6.8.0-1052.55
  • linux-gcp Ubuntu 25.10 6.17.0-1007.7
  • linux-gke Ubuntu 24.04 LTS 6.8.0-1048.53
  • linux-ibm Ubuntu 24.04 LTS 6.8.0-1049.49

ubuntu advisories UBUNTU-CVE-2025-40235

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel-rt Linux Micro 6.2 6.12.0-160000.9.1
  • kernel-64kb SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.9.1
  • kernel-source SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.9.1
  • kernel-default SLES 16.0, SLE High Availability Extension 16.0, Linux Micro 6.2 +1 more 6.12.0-160000.9.1
  • kernel-default-base SLES 16.0, Linux Micro 6.2, SLES for SAP applications 16.0 6.12.0-160000.9.1.160000.2.6
  • kernel-syms SLES 16.0, Linux Micro Extras 6.2, SLES for SAP applications 16.0 6.12.0-160000.9.1
  • kernel-azure SLES for SAP applications 16.0, SLES 16.0 6.12.0-160000.9.1
  • kernel-obs-qa SLES for SAP applications 16.0, SLES 16.0 6.12.0-160000.9.1

suse advisories SUSE-SU-2026:20207-1SUSE-SU-2026:20220-1SUSE-SU-2026:20564-1SUSE-SU-2026:20228-1

  • kernel-rt openSUSE Leap 16.0 6.12.0-160000.9.1
  • dtb-aarch64 openSUSE Leap 16.0 6.12.0-160000.9.1
  • kernel-64kb openSUSE Leap 16.0 6.12.0-160000.9.1
  • kernel-syms openSUSE Leap 16.0 6.12.0-160000.9.1
  • kernel-azure openSUSE Leap 16.0 6.12.0-160000.9.1
  • kernel-obs-qa openSUSE Leap 16.0 6.12.0-160000.9.1
  • kernel-source openSUSE Leap 16.0 6.12.0-160000.9.1
  • kernel-default openSUSE Leap 16.0 6.12.0-160000.9.1

opensuse advisories openSUSE-SU-2026:20145-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-40235 updated cvss 5.5

kernel: btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots()

  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.21% chance of exploitation in the next 30 days, higher than 11% of all scored CVEs (FIRST EPSS, 2026-11-08).

Affected products

  • Linux Linux

Classification

Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.