Listen to this Post
The CVE-2025-38358 vulnerability is a race condition between the Btrfs filesystem’s asynchronous metadata reclaim worker and the filesystem teardown process (close_ctree()). During unmount, `close_ctree()` sets the `BTRFS_FS_STATE_NO_DELAYED_IPUT` flag, which prevents new delayed inode references from being queued. However, the async reclaim worker can be in the middle of writing back data for a inode. After this writeback completes, the worker attempts to add a “delayed iput” for the inode. If the unmount process has already set the `NO_DELAYED_IPUT` flag before the worker finishes, the kernel triggers a warning due to the invalid attempt to add a delayed iput when it is no longer permitted. This results from improper synchronization where the flag was set before ensuring all reclaim workers had completely stopped and finished their inode processing.
Platform: Linux Kernel
Version: Up to 6.15
Vulnerability : Race Condition
Severity: Medium
date: 07/25/2025
Prediction: Patch expected by early August 2025
What Undercode Say:
grep -r "BTRFS_FS_STATE_NO_DELAYED_IPUT" /usr/src/linux/
// Code snippet from btrfs_inode.c showing the assertion WARN_ON(test_bit(BTRFS_FS_STATE_NO_DELAYED_IPUT, &fs_info->fs_state));
Checking kernel logs for the warning dmesg | grep "btrfs_add_delayed_iput"
How Exploit:
A local user could potentially repeatedly mount and unmount a Btrfs filesystem or trigger heavy writeback activity to increase the race condition window, leading to a kernel warning and potential denial-of-service by crashing the system or corrupting kernel state.
Protection from this CVE
Apply the kernel patch that reorders the operations in close_ctree(), ensuring `BTRFS_FS_STATE_NO_DELAYED_IPUT` is set only after all async reclaim workers have been canceled and any pending delayed iputs have been run.
Impact:
Kernel warning (denial-of-service), potential for unstable system state during Btrfs unmount, but no direct privilege escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
