VYPR
← All advisories
Medium severity5.5NVD Advisory· Published May 20, 2025· Updated May 12, 2026

CVE-2025-37931

CVE-2025-37931

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: adjust subpage bit start based on sectorsize

When running machines with 64k page size and a 16k nodesize we started seeing tree log corruption in production. This turned out to be because we were not writing out dirty blocks sometimes, so this in fact affects all metadata writes.

When writing out a subpage EB we scan the subpage bitmap for a dirty range. If the range isn't dirty we do

bit_start++;

to move onto the next bit. The problem is the bitmap is based on the number of sectors that an EB has. So in this case, we have a 64k pagesize, 16k nodesize, but a 4k sectorsize. This means our bitmap is 4 bits for every node. With a 64k page size we end up with 4 nodes per page.

To make this easier this is how everything looks

[0 16k 32k 48k ] logical address [0 4 8 12 ] radix tree offset [ 64k page ] folio [ 16k eb ][ 16k eb ][ 16k eb ][ 16k eb ] extent buffers [ | | | | | | | | | | | | | | | | ] bitmap

Now we use all of our addressing based on fs_info->sectorsize_bits, so as you can see the above our 16k eb->start turns into radix entry 4.

When we find a dirty range for our eb, we correctly do bit_start += sectors_per_node, because if we start at bit 0, the next bit for the next eb is 4, to correspond to eb->start 16k.

However if our range is clean, we will do bit_start++, which will now put us offset from our radix tree entries.

In our case, assume that the first time we check the bitmap the block is not dirty, we increment bit_start so now it == 1, and then we loop around and check again. This time it is dirty, and we go to find that start using the following equation

start = folio_start + bit_start * fs_info->sectorsize;

so in the case above, eb->start 0 is now dirty, and we calculate start as

0 + 1 * fs_info->sectorsize = 4096 4096 >> 12 = 1

Now we're looking up the radix tree for 1, and we won't find an eb. What's worse is now we're using bit_start == 1, so we do bit_start += sectors_per_node, which is now 5. If that eb is dirty we will run into the same thing, we will look at an offset that is not populated in the radix tree, and now we're skipping the writeout of dirty extent buffers.

The best fix for this is to not use sectorsize_bits to address nodes, but that's a larger change. Since this is a fs corruption problem fix it simply by always using sectors_per_node to increment the start bit.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

In the Linux kernel, a btrfs subpage bitmap indexing error causes metadata corruption on systems with 64k pagesize and 16k nodesize.

CVE-2025-37931 is a vulnerability in the Linux kernel's btrfs filesystem, specifically in the handling of subpage extent buffers (EB) during metadata write-out. When the system uses a 64k page size, a 16k nodesize, and a 4k sectorsize, the subpage bitmap incorrectly increments the bit start index by 1 when a range is not dirty, rather than by the number of sectors per node. This misalignment between the bitmap index and the radix tree offset causes the kernel to look up the wrong radix tree entry, failing to find the corresponding EB and thus not writing out dirty blocks [1]. As a result, metadata writes are silently lost, leading to file system corruption.

Exploitation of this vulnerability requires no special privileges beyond normal file system operations that trigger metadata writes. The bug manifests on systems with 64k page size and a nodesize that is a multiple of the sector size (e.g., 16k nodesize with 4k sectorsize). An attacker with local access could exploit this by triggering file system operations that cause btrfs to write out metadata, resulting in persistent corruption. No authentication is needed beyond standard user access to the file system.

The primary impact is file system metadata corruption, which can lead to data loss, file system inconsistency, and potential denial of service. In production environments, this has been observed as tree log corruption, making the file system unreliable. The vulnerability could be leveraged by a local attacker to degrade system integrity or cause a crash.

A fix for this issue has been committed to the Linux kernel stable tree (e.g., commits 5111b148360f, 977849e8acd, b80db09b614) [2][3][4]. Users should update their kernels to the latest stable release. The Siemens advisory (SSA-032379) lists this CVE as affecting SIMATIC CN 4100 versions prior to V5.0, with a recommended upgrade to V5.0 or later [1].

References
  1. SSA-032379
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!
  4. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

81

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

1