CVE-2025-21752 (GCVE-0-2025-21752)

Vulnerability from cvelistv5 – Published: 2025-02-27 02:12 – Updated: 2026-05-23 15:57
VLAI
Title
btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents Don't use btrfs_set_item_key_safe() to modify the keys in the RAID stripe-tree, as this can lead to corruption of the tree, which is caught by the checks in btrfs_set_item_key_safe(): BTRFS info (device nvme1n1): leaf 49168384 gen 15 total ptrs 194 free space 8329 owner 12 BTRFS info (device nvme1n1): refs 2 lock_owner 1030 current 1030 [ snip ] item 105 key (354549760 230 20480) itemoff 14587 itemsize 16 stride 0 devid 5 physical 67502080 item 106 key (354631680 230 4096) itemoff 14571 itemsize 16 stride 0 devid 1 physical 88559616 item 107 key (354631680 230 32768) itemoff 14555 itemsize 16 stride 0 devid 1 physical 88555520 item 108 key (354717696 230 28672) itemoff 14539 itemsize 16 stride 0 devid 2 physical 67604480 [ snip ] BTRFS critical (device nvme1n1): slot 106 key (354631680 230 32768) new key (354635776 230 4096) ------------[ cut here ]------------ kernel BUG at fs/btrfs/ctree.c:2602! Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI CPU: 1 UID: 0 PID: 1055 Comm: fsstress Not tainted 6.13.0-rc1+ #1464 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 RIP: 0010:btrfs_set_item_key_safe+0xf7/0x270 Code: <snip> RSP: 0018:ffffc90001337ab0 EFLAGS: 00010287 RAX: 0000000000000000 RBX: ffff8881115fd000 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000001 RDI: 00000000ffffffff RBP: ffff888110ed6f50 R08: 00000000ffffefff R09: ffffffff8244c500 R10: 00000000ffffefff R11: 00000000ffffffff R12: ffff888100586000 R13: 00000000000000c9 R14: ffffc90001337b1f R15: ffff888110f23b58 FS: 00007f7d75c72740(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa811652c60 CR3: 0000000111398001 CR4: 0000000000370eb0 Call Trace: <TASK> ? __die_body.cold+0x14/0x1a ? die+0x2e/0x50 ? do_trap+0xca/0x110 ? do_error_trap+0x65/0x80 ? btrfs_set_item_key_safe+0xf7/0x270 ? exc_invalid_op+0x50/0x70 ? btrfs_set_item_key_safe+0xf7/0x270 ? asm_exc_invalid_op+0x1a/0x20 ? btrfs_set_item_key_safe+0xf7/0x270 btrfs_partially_delete_raid_extent+0xc4/0xe0 btrfs_delete_raid_extent+0x227/0x240 __btrfs_free_extent.isra.0+0x57f/0x9c0 ? exc_coproc_segment_overrun+0x40/0x40 __btrfs_run_delayed_refs+0x2fa/0xe80 btrfs_run_delayed_refs+0x81/0xe0 btrfs_commit_transaction+0x2dd/0xbe0 ? preempt_count_add+0x52/0xb0 btrfs_sync_file+0x375/0x4c0 do_fsync+0x39/0x70 __x64_sys_fsync+0x13/0x20 do_syscall_64+0x54/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f7d7550ef90 Code: <snip> RSP: 002b:00007ffd70237248 EFLAGS: 00000202 ORIG_RAX: 000000000000004a RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f7d7550ef90 RDX: 000000000000013a RSI: 000000000040eb28 RDI: 0000000000000004 RBP: 000000000000001b R08: 0000000000000078 R09: 00007ffd7023725c R10: 00007f7d75400390 R11: 0000000000000202 R12: 028f5c28f5c28f5c R13: 8f5c28f5c28f5c29 R14: 000000000040b520 R15: 00007f7d75c726c8 </TASK> While the root cause of the tree order corruption isn't clear, using btrfs_duplicate_item() to copy the item and then adjusting both the key and the per-device physical addresses is a safe way to counter this problem.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 02c372e1f016e5113217597ab37b399c4e407477 , < 1c25eff52ee5a02a2c4be659a44ae972d9989742 (git)
Affected: 02c372e1f016e5113217597ab37b399c4e407477 , < dc14ba10781bd2629835696b7cc1febf914768e9 (git)
Affected: ab69bf6f8970c09d3735c25094e9471d54365282 (git)
Affected: 6.6.130 , < 6.7 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.13.3 , ≤ 6.13.* (semver)
Unaffected: 6.14 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/raid-stripe-tree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1c25eff52ee5a02a2c4be659a44ae972d9989742",
              "status": "affected",
              "version": "02c372e1f016e5113217597ab37b399c4e407477",
              "versionType": "git"
            },
            {
              "lessThan": "dc14ba10781bd2629835696b7cc1febf914768e9",
              "status": "affected",
              "version": "02c372e1f016e5113217597ab37b399c4e407477",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ab69bf6f8970c09d3735c25094e9471d54365282",
              "versionType": "git"
            },
            {
              "lessThan": "6.7",
              "status": "affected",
              "version": "6.6.130",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/raid-stripe-tree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.13.*",
              "status": "unaffected",
              "version": "6.13.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.14",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13.3",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.130",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don\u0027t use btrfs_set_item_key_safe on RAID stripe-extents\n\nDon\u0027t use btrfs_set_item_key_safe() to modify the keys in the RAID\nstripe-tree, as this can lead to corruption of the tree, which is caught\nby the checks in btrfs_set_item_key_safe():\n\n BTRFS info (device nvme1n1): leaf 49168384 gen 15 total ptrs 194 free space 8329 owner 12\n BTRFS info (device nvme1n1): refs 2 lock_owner 1030 current 1030\n  [ snip ]\n  item 105 key (354549760 230 20480) itemoff 14587 itemsize 16\n                  stride 0 devid 5 physical 67502080\n  item 106 key (354631680 230 4096) itemoff 14571 itemsize 16\n                  stride 0 devid 1 physical 88559616\n  item 107 key (354631680 230 32768) itemoff 14555 itemsize 16\n                  stride 0 devid 1 physical 88555520\n  item 108 key (354717696 230 28672) itemoff 14539 itemsize 16\n                  stride 0 devid 2 physical 67604480\n  [ snip ]\n BTRFS critical (device nvme1n1): slot 106 key (354631680 230 32768) new key (354635776 230 4096)\n ------------[ cut here ]------------\n kernel BUG at fs/btrfs/ctree.c:2602!\n Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI\n CPU: 1 UID: 0 PID: 1055 Comm: fsstress Not tainted 6.13.0-rc1+ #1464\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014\n RIP: 0010:btrfs_set_item_key_safe+0xf7/0x270\n Code: \u003csnip\u003e\n RSP: 0018:ffffc90001337ab0 EFLAGS: 00010287\n RAX: 0000000000000000 RBX: ffff8881115fd000 RCX: 0000000000000000\n RDX: 0000000000000001 RSI: 0000000000000001 RDI: 00000000ffffffff\n RBP: ffff888110ed6f50 R08: 00000000ffffefff R09: ffffffff8244c500\n R10: 00000000ffffefff R11: 00000000ffffffff R12: ffff888100586000\n R13: 00000000000000c9 R14: ffffc90001337b1f R15: ffff888110f23b58\n FS:  00007f7d75c72740(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007fa811652c60 CR3: 0000000111398001 CR4: 0000000000370eb0\n Call Trace:\n  \u003cTASK\u003e\n  ? __die_body.cold+0x14/0x1a\n  ? die+0x2e/0x50\n  ? do_trap+0xca/0x110\n  ? do_error_trap+0x65/0x80\n  ? btrfs_set_item_key_safe+0xf7/0x270\n  ? exc_invalid_op+0x50/0x70\n  ? btrfs_set_item_key_safe+0xf7/0x270\n  ? asm_exc_invalid_op+0x1a/0x20\n  ? btrfs_set_item_key_safe+0xf7/0x270\n  btrfs_partially_delete_raid_extent+0xc4/0xe0\n  btrfs_delete_raid_extent+0x227/0x240\n  __btrfs_free_extent.isra.0+0x57f/0x9c0\n  ? exc_coproc_segment_overrun+0x40/0x40\n  __btrfs_run_delayed_refs+0x2fa/0xe80\n  btrfs_run_delayed_refs+0x81/0xe0\n  btrfs_commit_transaction+0x2dd/0xbe0\n  ? preempt_count_add+0x52/0xb0\n  btrfs_sync_file+0x375/0x4c0\n  do_fsync+0x39/0x70\n  __x64_sys_fsync+0x13/0x20\n  do_syscall_64+0x54/0x110\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n RIP: 0033:0x7f7d7550ef90\n Code: \u003csnip\u003e\n RSP: 002b:00007ffd70237248 EFLAGS: 00000202 ORIG_RAX: 000000000000004a\n RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f7d7550ef90\n RDX: 000000000000013a RSI: 000000000040eb28 RDI: 0000000000000004\n RBP: 000000000000001b R08: 0000000000000078 R09: 00007ffd7023725c\n R10: 00007f7d75400390 R11: 0000000000000202 R12: 028f5c28f5c28f5c\n R13: 8f5c28f5c28f5c29 R14: 000000000040b520 R15: 00007f7d75c726c8\n  \u003c/TASK\u003e\n\nWhile the root cause of the tree order corruption isn\u0027t clear, using\nbtrfs_duplicate_item() to copy the item and then adjusting both the key\nand the per-device physical addresses is a safe way to counter this\nproblem."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:57:04.757Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1c25eff52ee5a02a2c4be659a44ae972d9989742"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc14ba10781bd2629835696b7cc1febf914768e9"
        }
      ],
      "title": "btrfs: don\u0027t use btrfs_set_item_key_safe on RAID stripe-extents",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21752",
    "datePublished": "2025-02-27T02:12:22.741Z",
    "dateReserved": "2024-12-29T08:45:45.759Z",
    "dateUpdated": "2026-05-23T15:57:04.757Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-21752",
      "date": "2026-09-25",
      "epss": "0.00174",
      "percentile": "0.06045"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T02:15:17.000Z",
      "cve": "CVE-2025-21752",
      "id": "msrc_CVE-2025-21752",
      "initial_release_date": "2026-05-25T01:01:22.000Z",
      "product_status:known_affected": "8",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "btrfs: don\u0027t use btrfs_set_item_key_safe on RAID stripe-extents",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2025-21752.json",
      "version": "10"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/btrfs/raid-stripe-tree.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "1c25eff52ee5a02a2c4be659a44ae972d9989742",
                    "status": "affected",
                    "version": "02c372e1f016e5113217597ab37b399c4e407477",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dc14ba10781bd2629835696b7cc1febf914768e9",
                    "status": "affected",
                    "version": "02c372e1f016e5113217597ab37b399c4e407477",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "ab69bf6f8970c09d3735c25094e9471d54365282",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.7",
                    "status": "affected",
                    "version": "6.6.130",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/btrfs/raid-stripe-tree.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.7"
                  },
                  {
                    "lessThan": "6.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.13.*",
                    "status": "unaffected",
                    "version": "6.13.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.14",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "941059EE-3795-4937-9F99-D94419C9010D",
                    "versionEndExcluding": "6.13.3",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: don\u0027t use btrfs_set_item_key_safe on RAID stripe-extents\n\nDon\u0027t use btrfs_set_item_key_safe() to modify the keys in the RAID\nstripe-tree, as this can lead to corruption of the tree, which is caught\nby the checks in btrfs_set_item_key_safe():\n\n BTRFS info (device nvme1n1): leaf 49168384 gen 15 total ptrs 194 free space 8329 owner 12\n BTRFS info (device nvme1n1): refs 2 lock_owner 1030 current 1030\n  [ snip ]\n  item 105 key (354549760 230 20480) itemoff 14587 itemsize 16\n                  stride 0 devid 5 physical 67502080\n  item 106 key (354631680 230 4096) itemoff 14571 itemsize 16\n                  stride 0 devid 1 physical 88559616\n  item 107 key (354631680 230 32768) itemoff 14555 itemsize 16\n                  stride 0 devid 1 physical 88555520\n  item 108 key (354717696 230 28672) itemoff 14539 itemsize 16\n                  stride 0 devid 2 physical 67604480\n  [ snip ]\n BTRFS critical (device nvme1n1): slot 106 key (354631680 230 32768) new key (354635776 230 4096)\n ------------[ cut here ]------------\n kernel BUG at fs/btrfs/ctree.c:2602!\n Oops: invalid opcode: 0000 [#1] PREEMPT SMP PTI\n CPU: 1 UID: 0 PID: 1055 Comm: fsstress Not tainted 6.13.0-rc1+ #1464\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014\n RIP: 0010:btrfs_set_item_key_safe+0xf7/0x270\n Code: \u003csnip\u003e\n RSP: 0018:ffffc90001337ab0 EFLAGS: 00010287\n RAX: 0000000000000000 RBX: ffff8881115fd000 RCX: 0000000000000000\n RDX: 0000000000000001 RSI: 0000000000000001 RDI: 00000000ffffffff\n RBP: ffff888110ed6f50 R08: 00000000ffffefff R09: ffffffff8244c500\n R10: 00000000ffffefff R11: 00000000ffffffff R12: ffff888100586000\n R13: 00000000000000c9 R14: ffffc90001337b1f R15: ffff888110f23b58\n FS:  00007f7d75c72740(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000\n CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007fa811652c60 CR3: 0000000111398001 CR4: 0000000000370eb0\n Call Trace:\n  \u003cTASK\u003e\n  ? __die_body.cold+0x14/0x1a\n  ? die+0x2e/0x50\n  ? do_trap+0xca/0x110\n  ? do_error_trap+0x65/0x80\n  ? btrfs_set_item_key_safe+0xf7/0x270\n  ? exc_invalid_op+0x50/0x70\n  ? btrfs_set_item_key_safe+0xf7/0x270\n  ? asm_exc_invalid_op+0x1a/0x20\n  ? btrfs_set_item_key_safe+0xf7/0x270\n  btrfs_partially_delete_raid_extent+0xc4/0xe0\n  btrfs_delete_raid_extent+0x227/0x240\n  __btrfs_free_extent.isra.0+0x57f/0x9c0\n  ? exc_coproc_segment_overrun+0x40/0x40\n  __btrfs_run_delayed_refs+0x2fa/0xe80\n  btrfs_run_delayed_refs+0x81/0xe0\n  btrfs_commit_transaction+0x2dd/0xbe0\n  ? preempt_count_add+0x52/0xb0\n  btrfs_sync_file+0x375/0x4c0\n  do_fsync+0x39/0x70\n  __x64_sys_fsync+0x13/0x20\n  do_syscall_64+0x54/0x110\n  entry_SYSCALL_64_after_hwframe+0x76/0x7e\n RIP: 0033:0x7f7d7550ef90\n Code: \u003csnip\u003e\n RSP: 002b:00007ffd70237248 EFLAGS: 00000202 ORIG_RAX: 000000000000004a\n RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f7d7550ef90\n RDX: 000000000000013a RSI: 000000000040eb28 RDI: 0000000000000004\n RBP: 000000000000001b R08: 0000000000000078 R09: 00007ffd7023725c\n R10: 00007f7d75400390 R11: 0000000000000202 R12: 028f5c28f5c28f5c\n R13: 8f5c28f5c28f5c29 R14: 000000000040b520 R15: 00007f7d75c726c8\n  \u003c/TASK\u003e\n\nWhile the root cause of the tree order corruption isn\u0027t clear, using\nbtrfs_duplicate_item() to copy the item and then adjusting both the key\nand the per-device physical addresses is a safe way to counter this\nproblem."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: btrfs: no use btrfs_set_item_key_safe en extensiones de bandas RAID No use btrfs_set_item_key_safe() para modificar las claves en el \u00e1rbol de bandas RAID, ya que esto puede provocar la corrupci\u00f3n del \u00e1rbol, lo que es detectado por las comprobaciones en btrfs_set_item_key_safe(): Informaci\u00f3n de BTRFS (dispositivo nvme1n1): leaf 49168384 gen 15 total ptrs 194 free space 8329 owner 12 Informaci\u00f3n de BTRFS (dispositivo nvme1n1): refs 2 lock_owner 1030 current 1030 [ snip ] item 105 key (354549760 230 20480) itemoff 14587 itemsize 16 stride 0 devid 5 physical 67502080 elemento 106 clave (354631680 230 4096) itemoff 14571 tama\u00f1o del elemento 16 paso 0 devid 1 f\u00edsico 88559616 elemento 107 clave (354631680 230 32768) itemoff 14555 tama\u00f1o del elemento 16 paso 0 devid 1 f\u00edsico 88555520 elemento 108 clave (354717696 230 28672) itemoff 14539 tama\u00f1o del elemento 16 paso 0 devid 2 f\u00edsico 67604480 [ snip ] BTRFS cr\u00edtico (dispositivo nvme1n1): ranura 106 clave (354631680 230 32768) nueva clave (354635776 230 4096) ------------[ cortar aqu\u00ed ]------------ \u00a1ERROR del kernel en fs/btrfs/ctree.c:2602! Oops: c\u00f3digo de operaci\u00f3n no v\u00e1lido: 0000 [#1] PREEMPT SMP PTI CPU: 1 UID: 0 PID: 1055 Comm: fsstress No contaminado 6.13.0-rc1+ #1464 Nombre del hardware: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 01/04/2014 RIP: 0010:btrfs_set_item_key_safe+0xf7/0x270 C\u00f3digo:  RSP: 0018:ffffc90001337ab0 EFLAGS: 00010287 RAX: 000000000000000 RBX: ffff8881115fd000 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 000000000000001 RDI: 000000000ffffffff RBP: ffff888110ed6f50 R08: 00000000ffffefff R09: ffffffff8244c500 R10: 00000000ffffefff R11: 00000000ffffffff R12: ffff888100586000 R13: 00000000000000c9 R14: ffffc90001337b1f R15: ffff888110f23b58 FS: 00007f7d75c72740(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa811652c60 CR3: 0000000111398001 CR4: 0000000000370eb0 Seguimiento de llamadas:  ? __die_body.cold+0x14/0x1a ? die+0x2e/0x50 ? do_trap+0xca/0x110 ? btrfs_set_item_key_safe+0xf7/0x270 ? exc_invalid_op+0x50/0x70 ? btrfs_set_item_key_safe+0xf7/0x270 ? asm_exc_invalid_op+0x1a/0x20 ? btrfs_set_item_key_safe+0xf7/0x270 btrfs_partially_delete_raid_extent+0xc4/0xe0 btrfs_delete_raid_extent+0x227/0x240 __btrfs_free_extent.isra.0+0x57f/0x9c0 ? exc_coproc_segment_overrun+0x40/0x40 __btrfs_run_delayed_refs+0x2fa/0xe80 btrfs_run_delayed_refs+0x81/0xe0 btrfs_commit_transaction+0x2dd/0xbe0 ? preempt_count_add+0x52/0xb0 btrfs_sync_file+0x375/0x4c0 do_fsync+0x39/0x70 __x64_sys_fsync+0x13/0x20 do_syscall_64+0x54/0x110 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f7d7550ef90 C\u00f3digo:  RSP: 002b:00007ffd70237248 EFLAGS: 00000202 ORIG_RAX: 000000000000004a RAX: ffffffffffffffda RBX: 000000000000004 RCX: 00007f7d7550ef90 RDX: 000000000000013a RSI: 000000000040eb28 RDI: 0000000000000004 RBP: 000000000000001b R08: 0000000000000078 R09: 00007ffd7023725c R10: 00007f7d75400390 R11: 0000000000000202 R12: 028f5c28f5c28f5c R13: 8f5c28f5c28f5c29 R14: 000000000040b520 R15: 00007f7d75c726c8  Si bien la causa ra\u00edz de la corrupci\u00f3n del orden del \u00e1rbol no est\u00e1 clara, usar btrfs_duplicate_item() para copiar el elemento y luego ajustar tanto la clave como las direcciones f\u00edsicas por dispositivo es una forma segura de contrarrestar este problema."
          }
        ],
        "id": "CVE-2025-21752",
        "lastModified": "2026-06-17T08:44:11.443",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-02-27T03:15:15.853",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1c25eff52ee5a02a2c4be659a44ae972d9989742"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/dc14ba10781bd2629835696b7cc1febf914768e9"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:32:25+00:00",
      "cve": "CVE-2025-21752",
      "id": "CVE-2025-21752",
      "initial_release_date": "2025-02-27T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: btrfs: don\u0027t use btrfs_set_item_key_safe on RAID stripe-extents",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-21752.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.