In the Linux kernel, the following vulnerability has been resolved:
btrfs: qgroup: fix race between quota disable and quota rescan ioctl
There's a race between a task disabling quotas and another running the rescan ioctl that can result in a use-after-free of qgroup records from the fsinfo->qgrouptree rbtree.
This happens as follows:
1) Task A enters btrfsioctlquotarescan() -> btrfsqgroup_rescan();
2) Task B enters btrfsquotadisable() and calls btrfsqgroupwaitforcompletion(), which does nothing because at that point fsinfo->qgrouprescan_running is false (it wasn't set yet by task A);
3) Task B calls btrfsfreeqgroupconfig() which starts freeing qgroups from fsinfo->qgrouptree without taking the lock fsinfo->qgroup_lock;
4) Task A enters qgrouprescanzerotracking() which starts iterating the fsinfo->qgrouptree tree while holding fsinfo->qgroup_lock, but task B is freeing qgroup records from that tree without holding the lock, resulting in a use-after-free.
Fix this by taking fsinfo->qgrouplock at btrfsfreeqgroupconfig(). Also at btrfsqgroup_rescan() don't start the rescan worker if quotas were already disabled.
[
{
"deprecated": false,
"id": "CVE-2025-39759-1d781392",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd0b28d877b293b1d7f8727a7de08ae36b6b9ef0",
"target": {
"file": "fs/btrfs/qgroup.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"328894255868628419985491678060298041696",
"9290429690171501038012617916602840885",
"68816336900351827422676550728881588148",
"115953295919934257223536109224005989716",
"167034228587438922520431199582604366025",
"37708323274591759133317959039478996932",
"233441703057455789339190334402070748029",
"140739900538943747571219827843097951033",
"60171144601634881558888121226614490698",
"168800690081137798413475596819774497072",
"11868222744778810127465168093382383387",
"28496182084947518281671381050048256994",
"321052024337669695824499613483407206472",
"86269862336526427499921605407882812111",
"154400376915613536302722070718865368639",
"69813482124431495765144326648618833307",
"299911309803003990132679690875921082990",
"222516708497829389703196474976208353415",
"240274697377155759180550718602132078626",
"301554364136785712491517732044614705628",
"102713636929448078772687489309959926112",
"210808924914909072060079509539774897770"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-39759-3d3316ac",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b172535ccba12f0cf7d23b3b840989de47fc104d",
"target": {
"file": "fs/btrfs/qgroup.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"328894255868628419985491678060298041696",
"9290429690171501038012617916602840885",
"68816336900351827422676550728881588148",
"115953295919934257223536109224005989716",
"167034228587438922520431199582604366025",
"37708323274591759133317959039478996932",
"233441703057455789339190334402070748029",
"78020937040465590139266257890792392337",
"86761414641883622302834203545052945798",
"78743369407073694434501353745230037905",
"66110886832303203769274733577773993857",
"28496182084947518281671381050048256994",
"321052024337669695824499613483407206472",
"86269862336526427499921605407882812111",
"154400376915613536302722070718865368639",
"69813482124431495765144326648618833307",
"299911309803003990132679690875921082990",
"222516708497829389703196474976208353415",
"240274697377155759180550718602132078626",
"301554364136785712491517732044614705628",
"102713636929448078772687489309959926112",
"210808924914909072060079509539774897770"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-39759-49d74128",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd0b28d877b293b1d7f8727a7de08ae36b6b9ef0",
"target": {
"file": "fs/btrfs/qgroup.c",
"function": "btrfs_free_qgroup_config"
},
"digest": {
"function_hash": "174343197897657788131371271660849341946",
"length": 362.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39759-4f64a68b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7cda0fdde5d9890976861421d207870500f9aace",
"target": {
"file": "fs/btrfs/qgroup.c",
"function": "btrfs_qgroup_rescan"
},
"digest": {
"function_hash": "61233328739820675524175455913134747625",
"length": 630.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39759-733e664a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b172535ccba12f0cf7d23b3b840989de47fc104d",
"target": {
"file": "fs/btrfs/qgroup.c",
"function": "btrfs_qgroup_rescan"
},
"digest": {
"function_hash": "89472660912078929597253479666855694535",
"length": 707.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39759-7557f460",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c38028ce0d0045ca600b6a8345a0ff92bfb47b66",
"target": {
"file": "fs/btrfs/qgroup.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"328894255868628419985491678060298041696",
"9290429690171501038012617916602840885",
"68816336900351827422676550728881588148",
"115953295919934257223536109224005989716",
"167034228587438922520431199582604366025",
"37708323274591759133317959039478996932",
"233441703057455789339190334402070748029",
"140739900538943747571219827843097951033",
"60171144601634881558888121226614490698",
"168800690081137798413475596819774497072",
"11868222744778810127465168093382383387",
"28496182084947518281671381050048256994",
"321052024337669695824499613483407206472",
"86269862336526427499921605407882812111",
"154400376915613536302722070718865368639",
"69813482124431495765144326648618833307",
"299911309803003990132679690875921082990",
"222516708497829389703196474976208353415",
"240274697377155759180550718602132078626",
"301554364136785712491517732044614705628",
"102713636929448078772687489309959926112",
"210808924914909072060079509539774897770"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-39759-7b308914",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd0b28d877b293b1d7f8727a7de08ae36b6b9ef0",
"target": {
"file": "fs/btrfs/qgroup.c",
"function": "btrfs_qgroup_rescan"
},
"digest": {
"function_hash": "111157964639942398852745695157840468936",
"length": 477.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39759-acccae6c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c38028ce0d0045ca600b6a8345a0ff92bfb47b66",
"target": {
"file": "fs/btrfs/qgroup.c",
"function": "btrfs_qgroup_rescan"
},
"digest": {
"function_hash": "111157964639942398852745695157840468936",
"length": 477.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39759-e61f6698",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7cda0fdde5d9890976861421d207870500f9aace",
"target": {
"file": "fs/btrfs/qgroup.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"328894255868628419985491678060298041696",
"9290429690171501038012617916602840885",
"68816336900351827422676550728881588148",
"115953295919934257223536109224005989716",
"167034228587438922520431199582604366025",
"37708323274591759133317959039478996932",
"233441703057455789339190334402070748029",
"78020937040465590139266257890792392337",
"86761414641883622302834203545052945798",
"78743369407073694434501353745230037905",
"66110886832303203769274733577773993857",
"28496182084947518281671381050048256994",
"321052024337669695824499613483407206472",
"86269862336526427499921605407882812111",
"154400376915613536302722070718865368639",
"69813482124431495765144326648618833307",
"299911309803003990132679690875921082990",
"222516708497829389703196474976208353415",
"240274697377155759180550718602132078626",
"301554364136785712491517732044614705628",
"102713636929448078772687489309959926112",
"210808924914909072060079509539774897770"
]
}
},
{
"deprecated": false,
"id": "CVE-2025-39759-e67d9e47",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b172535ccba12f0cf7d23b3b840989de47fc104d",
"target": {
"file": "fs/btrfs/qgroup.c",
"function": "btrfs_free_qgroup_config"
},
"digest": {
"function_hash": "293621817430732535774513386425523227202",
"length": 370.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39759-f3cc6283",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7cda0fdde5d9890976861421d207870500f9aace",
"target": {
"file": "fs/btrfs/qgroup.c",
"function": "btrfs_free_qgroup_config"
},
"digest": {
"function_hash": "293621817430732535774513386425523227202",
"length": 370.0
}
},
{
"deprecated": false,
"id": "CVE-2025-39759-ffe21760",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c38028ce0d0045ca600b6a8345a0ff92bfb47b66",
"target": {
"file": "fs/btrfs/qgroup.c",
"function": "btrfs_free_qgroup_config"
},
"digest": {
"function_hash": "174343197897657788131371271660849341946",
"length": 362.0
}
}
]