CVE-2025-40209

Vulnerability

In the Linux kernel's btrfs filesystem, the function btrfs_add_qgroup_relation() fails to free a preallocated qgroup_list structure when called with invalid qgroup levels (src >= dst). The function performs a level validation check before acquiring a mutex and before any error handling path that would free the prealloc pointer. On failure, the function returns -EINVAL directly, skipping the cleanup code at the 'out' label which would have called kfree(prealloc).

Exploitation

The caller, btrfs_ioctl_qgroup_assign(), allocates the qgroup_list via kzalloc() and passes it to btrfs_add_qgroup_relation(). After the call, the caller unconditionally sets the pointer to NULL, meaning the allocated memory is never freed. An unprivileged user with write access to a btrfs mount can repeatedly trigger this code path by calling the ioctl with invalid qgroup IDs, causing a 64-byte memory leak per operation. This can be done without any special privileges beyond the ability to interact with a writable btrfs filesystem.

Impact

Repeated exploitation can exhaust kernel memory, leading to denial of service (system instability, out-of-memory kills, or system crash). The vulnerability is a classic memory leak that degrades system availability over time.

Mitigation

The fix involves freeing the prealloc structure before the early return in btrfs_add_qgroup_relation(), ensuring all error paths release the allocated memory. Patches have been committed to the stable kernel tree [1][2][3]. Users should update to a kernel containing the fix. No workaround other than restricting access to btrfs ioctls is available.