CVE-2025-40235
Description
In the Linux kernel, the following vulnerability has been resolved:
btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots()
If fs_info->super_copy or fs_info->super_for_commit allocated failed in btrfs_get_tree_subvol(), then no need to call btrfs_free_fs_info(). Otherwise btrfs_check_leaked_roots() would access NULL pointer because fs_info->allocated_roots had not been initialised.
syzkaller reported the following information: ------------[ cut here ]------------ BUG: unable to handle page fault for address: fffffffffffffbb0 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 64c9067 P4D 64c9067 PUD 64cb067 PMD 0 Oops: Oops: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 1402 Comm: syz.1.35 Not tainted 6.15.8 #4 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), (...) RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline] RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline] RIP: 0010:atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline] RIP: 0010:refcount_read include/linux/refcount.h:170 [inline] RIP: 0010:btrfs_check_leaked_roots+0x18f/0x2c0 fs/btrfs/disk-io.c:1230 [...] Call Trace:
btrfs_free_fs_info+0x310/0x410 fs/btrfs/disk-io.c:1280 btrfs_get_tree_subvol+0x592/0x6b0 fs/btrfs/super.c:2029 btrfs_get_tree+0x63/0x80 fs/btrfs/super.c:2097 vfs_get_tree+0x98/0x320 fs/super.c:1759 do_new_mount+0x357/0x660 fs/namespace.c:3899 path_mount+0x716/0x19c0 fs/namespace.c:4226 do_mount fs/namespace.c:4239 [inline] __do_sys_mount fs/namespace.c:4450 [inline] __se_sys_mount fs/namespace.c:4427 [inline] __x64_sys_mount+0x28c/0x310 fs/namespace.c:4427 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x92/0x180 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f032eaffa8d [...]
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
In btrfs, a NULL pointer dereference occurs when super_copy allocation fails, causing btrfs_check_leaked_roots() to access uninitialized allocated_roots.
Vulnerability
Description
In the Linux kernel's btrfs filesystem, a NULL pointer dereference vulnerability exists in the error handling path of btrfs_get_tree_subvol(). When memory allocation for fs_info->super_copy or fs_info->super_for_commit fails, the error path calls btrfs_free_fs_info(), which subsequently invokes btrfs_check_leaked_roots(). However, fs_info->allocated_roots is not initialized until after these allocations, so btrfs_check_leaked_roots() dereferences a NULL pointer, leading to a kernel crash. This is a use-before-initialization bug.
Exploitation
The vulnerability is triggered during the mount of a btrfs filesystem when memory allocation fails. An attacker with local access and the ability to mount filesystems (typically requiring root or CAP_SYS_ADMIN) can induce memory pressure to cause the allocation failure, resulting in a denial of service via kernel panic. No authentication beyond mount privileges is required. The syzkaller fuzzer reproduced the issue, as shown in the kernel bug report.
Impact
A local attacker can cause a system crash (NULL pointer dereference) leading to denial of service. The crash manifests as an Oops with a page fault at address 0xfffffffffffffbb0 in btrfs_check_leaked_roots(). The fix directly frees the partially initialized fs_info structure without calling btrfs_free_fs_info(), avoiding the uninitialized access.
Mitigation
The fix has been applied to the Linux kernel stable tree as commit b1c2b4e6ffd3 [1]. Users should update to a patched kernel version. No workaround is available; the vulnerability is only exploitable during mount failure, which is rare under normal operation.
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2Patches
3b1c2b4e6ffd30c2b2d4d053e17679ac6df6cVulnerability mechanics
Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3News mentions
0No linked articles in our index yet.