FKIE_CVE-2025-40209

Vulnerability from fkie_nvd - Published: 2025-11-21 11:15 - Updated: 2026-10-19 19:10
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation When btrfs_add_qgroup_relation() is called with invalid qgroup levels (src >= dst), the function returns -EINVAL directly without freeing the preallocated qgroup_list structure passed by the caller. This causes a memory leak because the caller unconditionally sets the pointer to NULL after the call, preventing any cleanup. The issue occurs because the level validation check happens before the mutex is acquired and before any error handling path that would free the prealloc pointer. On this early return, the cleanup code at the 'out' label (which includes kfree(prealloc)) is never reached. In btrfs_ioctl_qgroup_assign(), the code pattern is: prealloc = kzalloc(sizeof(*prealloc), GFP_KERNEL); ret = btrfs_add_qgroup_relation(trans, sa->src, sa->dst, prealloc); prealloc = NULL; // Always set to NULL regardless of return value ... kfree(prealloc); // This becomes kfree(NULL), does nothing When the level check fails, 'prealloc' is never freed by either the callee or the caller, resulting in a 64-byte memory leak per failed operation. This can be triggered repeatedly by an unprivileged user with access to a writable btrfs mount, potentially exhausting kernel memory. Fix this by freeing prealloc before the early return, ensuring prealloc is always freed on all error paths.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3412d0e973e8f8381747d69033eda809a57a2581
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a4d9ebe23bcb79d9d057e3c995db73b7b3aae414
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f260c6aff0b8af236084012d14f9f1bf792ea883
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/qgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3412d0e973e8f8381747d69033eda809a57a2581",
              "status": "affected",
              "version": "4addc1ffd67ad34394674dc91379dc04cfdd2537",
              "versionType": "git"
            },
            {
              "lessThan": "a4d9ebe23bcb79d9d057e3c995db73b7b3aae414",
              "status": "affected",
              "version": "4addc1ffd67ad34394674dc91379dc04cfdd2537",
              "versionType": "git"
            },
            {
              "lessThan": "f260c6aff0b8af236084012d14f9f1bf792ea883",
              "status": "affected",
              "version": "4addc1ffd67ad34394674dc91379dc04cfdd2537",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/qgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.58",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.17.*",
              "status": "unaffected",
              "version": "6.17.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation\n\nWhen btrfs_add_qgroup_relation() is called with invalid qgroup levels\n(src \u003e= dst), the function returns -EINVAL directly without freeing the\npreallocated qgroup_list structure passed by the caller. This causes a\nmemory leak because the caller unconditionally sets the pointer to NULL\nafter the call, preventing any cleanup.\n\nThe issue occurs because the level validation check happens before the\nmutex is acquired and before any error handling path that would free\nthe prealloc pointer. On this early return, the cleanup code at the\n\u0027out\u0027 label (which includes kfree(prealloc)) is never reached.\n\nIn btrfs_ioctl_qgroup_assign(), the code pattern is:\n\n    prealloc = kzalloc(sizeof(*prealloc), GFP_KERNEL);\n    ret = btrfs_add_qgroup_relation(trans, sa-\u003esrc, sa-\u003edst, prealloc);\n    prealloc = NULL;  // Always set to NULL regardless of return value\n    ...\n    kfree(prealloc);  // This becomes kfree(NULL), does nothing\n\nWhen the level check fails, \u0027prealloc\u0027 is never freed by either the\ncallee or the caller, resulting in a 64-byte memory leak per failed\noperation. This can be triggered repeatedly by an unprivileged user\nwith access to a writable btrfs mount, potentially exhausting kernel\nmemory.\n\nFix this by freeing prealloc before the early return, ensuring prealloc\nis always freed on all error paths."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbtrfs: corrige la fuga de memoria de qgroup_list en btrfs_add_qgroup_relation\n\nCuando se llama a btrfs_add_qgroup_relation() con niveles de qgroup inv\u00e1lidos (src \u003e= dst), la funci\u00f3n devuelve -EINVAL directamente sin liberar la estructura qgroup_list preasignada pasada por el llamador. Esto causa una fuga de memoria porque el llamador establece incondicionalmente el puntero en NULL despu\u00e9s de la llamada, impidiendo cualquier limpieza.\n\nEl problema ocurre porque la comprobaci\u00f3n de validaci\u00f3n de nivel sucede antes de que se adquiera el mutex y antes de cualquier ruta de manejo de errores que liberar\u00eda el puntero prealloc. En este retorno temprano, el c\u00f3digo de limpieza en la etiqueta \u0027out\u0027 (que incluye kfree(prealloc)) nunca se alcanza.\n\nEn btrfs_ioctl_qgroup_assign(), el patr\u00f3n de c\u00f3digo es:\n\n    prealloc = kzalloc(sizeof(prealloc), GFP_KERNEL);\n    ret = btrfs_add_qgroup_relation(trans, sa -\u003e src, sa -\u003e dst, prealloc);\n    prealloc = NULL; // Siempre se establece en NULL independientemente del valor de retorno\n    ...\n    kfree(prealloc); // Esto se convierte en kfree(NULL), no hace nada\n\nCuando la comprobaci\u00f3n de nivel falla, \u0027prealloc\u0027 nunca es liberado ni por el llamado ni por el llamador, lo que resulta en una fuga de memoria de 64 bytes por operaci\u00f3n fallida. Esto puede ser activado repetidamente por un usuario sin privilegios con acceso a un montaje btrfs escribible, agotando potencialmente la memoria del kernel.\n\nSolucione esto liberando prealloc antes del retorno temprano, asegurando que prealloc siempre se libere en todas las rutas de error."
    }
  ],
  "id": "CVE-2025-40209",
  "lastModified": "2026-10-19T19:10:00.130",
  "metrics": {},
  "published": "2025-11-21T11:15:47.000",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3412d0e973e8f8381747d69033eda809a57a2581"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a4d9ebe23bcb79d9d057e3c995db73b7b3aae414"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f260c6aff0b8af236084012d14f9f1bf792ea883"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Deferred"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.