CVE-2025-39800

Vulnerability

Analysis

The Linux kernel's btrfs filesystem contained a flaw in the btrfs_copy_root() function. When cloning an extent buffer, if the function encountered an unexpected generation number for that buffer, it would only produce a WARN_ON() message and continue the operation [1]. This meant that metadata with an incorrect generation could be persisted to disk, silently introducing corruption into the filesystem metadata.

Attack

Vector

The vulnerability is triggered during specific btrfs operations that call btrfs_copy_root(), which is an internal filesystem function. An attacker would need to be able to trigger such operations, potentially by mounting a crafted or corrupted btrfs image. No network-based attack vector is described; exploitation would likely require local access or the ability to inject a malicious filesystem image. The bug does not require authentication beyond the ability to invoke the relevant btrfs operations.

Impact

An unexpected generation in an extent buffer, left unchecked, could lead to filesystem metadata inconsistency. Over time, this can cause data corruption, filesystem instability, or denial of service. In the worst case, it might be leveraged to escalate into more severe integrity violations, though the assigned CVSS score (5.5, Medium) reflects the primary impact on availability and integrity without remote code execution.

Mitigation

The fix, merged into the stable kernel tree via commit references [2], [3], and [4], changes the behavior so that an unexpected generation causes the transaction to abort and returns -EUCLEAN (clean error) instead of proceeding with a warning. Users should apply the latest stable kernel update or the specific cherry-picked commit to their distribution's kernel to ensure protection.