btrfs: do not clean up repair bio if submit fails (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.33 % · percentile 26 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not clean up repair bio if submit fails The submit helper will always run bio_endio() on the bio if it fails to submit, so cleaning up the bio just leads to a variety of use-after-free and NULL pointer dereference bugs because we race with the endio function that is cleaning up the bio. Instead just return BLK_STS_OK as the repair function has to continue to process the rest of the pages, and the endio for the repair bio will do the appropriate cleanup for the page that it was given.
Weaknesses (CWE)
- CWE-416 — Use After Free
References
- https://git.kernel.org/stable/c/e7e1d15d2bd8c373cf621614ddd17971a2132713
- https://git.kernel.org/stable/c/7170875083254b51fcc5d67f96640977083f481e
- https://git.kernel.org/stable/c/e76c78c48902dae6fa612749f59162bca0a79e0b
- https://git.kernel.org/stable/c/d1cb11fb45ebbb1e7dfe5e9038b32ea72c184b14
- https://git.kernel.org/stable/c/8cbc3001a3264d998d6b6db3e23f935c158abd4d
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | Linux |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
European references
- ENISA EUVD · EUVD-2022-55057
- GCVE · GCVE-0-2022-49168
CERT-FR advisories
- CERTFR-2026-AVI-0167 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0758 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0756 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0743 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0670 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0650 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0625 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0529 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*< 5.10.248cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.184cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 5.16.19cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.17 < 5.17.2
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 6c387ab20db15f2bd448f7c508e2638101b16ea1 < e7e1d15d2bd8c373cf621614ddd17971a2132713 ; affected 6c387ab20db15f2bd448f7c508e2638101b16ea1 < 7170875083254b51fcc5d67f96640977083f481e ; affected 6c387ab20db15f2bd448f7c508e2638101b16ea1 < e76c78c48902dae6fa612749f59162bca0a79e0b ; affected 6c387ab20db15f2bd448f7c508e2638101b16ea1 < d1cb11fb45ebbb1e7dfe5e9038b32ea72c184b14 ; affected 6c387ab20db15f2bd448f7c508e2638101b16ea1 < 8cbc3001a3264d998d6b6db3e23f935c158abd4d |
| Linux · Linux | affected 3.18 ; unaffected 0 < 3.18 ; unaffected 5.10.248 ≤ 5.10.* ; unaffected 5.15.184 ≤ 5.15.* ; unaffected 5.16.19 ≤ 5.16.* ; unaffected 5.17.2 ≤ 5.17.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |