In the Linux kernel, the following vulnerability has been resolved:
btrfs: qgroup: fix race between quota disable and quota rescan ioctl
There's a race between a task disabling quotas and another running the rescan ioctl that can result in a use-after-free of qgroup records from the fsinfo->qgrouptree rbtree.
This happens as follows:
1) Task A enters btrfsioctlquotarescan() -> btrfsqgroup_rescan();
2) Task B enters btrfsquotadisable() and calls btrfsqgroupwaitforcompletion(), which does nothing because at that point fsinfo->qgrouprescan_running is false (it wasn't set yet by task A);
3) Task B calls btrfsfreeqgroupconfig() which starts freeing qgroups from fsinfo->qgrouptree without taking the lock fsinfo->qgroup_lock;
4) Task A enters qgrouprescanzerotracking() which starts iterating the fsinfo->qgrouptree tree while holding fsinfo->qgroup_lock, but task B is freeing qgroup records from that tree without holding the lock, resulting in a use-after-free.
Fix this by taking fsinfo->qgrouplock at btrfsfreeqgroupconfig(). Also at btrfsqgroup_rescan() don't start the rescan worker if quotas were already disabled.
{ "vanir_signatures": [ { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2fd0f5ceb997f90f4332ccbab6c7e907e6b2d0eb", "deprecated": false, "id": "CVE-2025-39759-17bcdc2b", "signature_type": "Function", "digest": { "length": 477.0, "function_hash": "111157964639942398852745695157840468936" }, "target": { "file": "fs/btrfs/qgroup.c", "function": "btrfs_qgroup_rescan" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd0b28d877b293b1d7f8727a7de08ae36b6b9ef0", "deprecated": false, "id": "CVE-2025-39759-1d781392", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "328894255868628419985491678060298041696", "9290429690171501038012617916602840885", "68816336900351827422676550728881588148", "115953295919934257223536109224005989716", "167034228587438922520431199582604366025", "37708323274591759133317959039478996932", "233441703057455789339190334402070748029", "140739900538943747571219827843097951033", "60171144601634881558888121226614490698", "168800690081137798413475596819774497072", "11868222744778810127465168093382383387", "28496182084947518281671381050048256994", "321052024337669695824499613483407206472", "86269862336526427499921605407882812111", "154400376915613536302722070718865368639", "69813482124431495765144326648618833307", "299911309803003990132679690875921082990", "222516708497829389703196474976208353415", "240274697377155759180550718602132078626", "301554364136785712491517732044614705628", "102713636929448078772687489309959926112", "210808924914909072060079509539774897770" ] }, "target": { "file": "fs/btrfs/qgroup.c" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b172535ccba12f0cf7d23b3b840989de47fc104d", "deprecated": false, "id": "CVE-2025-39759-3d3316ac", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "328894255868628419985491678060298041696", "9290429690171501038012617916602840885", "68816336900351827422676550728881588148", "115953295919934257223536109224005989716", "167034228587438922520431199582604366025", "37708323274591759133317959039478996932", "233441703057455789339190334402070748029", "78020937040465590139266257890792392337", "86761414641883622302834203545052945798", "78743369407073694434501353745230037905", "66110886832303203769274733577773993857", "28496182084947518281671381050048256994", "321052024337669695824499613483407206472", "86269862336526427499921605407882812111", "154400376915613536302722070718865368639", "69813482124431495765144326648618833307", "299911309803003990132679690875921082990", "222516708497829389703196474976208353415", "240274697377155759180550718602132078626", "301554364136785712491517732044614705628", "102713636929448078772687489309959926112", "210808924914909072060079509539774897770" ] }, "target": { "file": "fs/btrfs/qgroup.c" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e1249667750399a48cafcf5945761d39fa584edf", "deprecated": false, "id": "CVE-2025-39759-4953b478", "signature_type": "Function", "digest": { "length": 362.0, "function_hash": "174343197897657788131371271660849341946" }, "target": { "file": "fs/btrfs/qgroup.c", "function": "btrfs_free_qgroup_config" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd0b28d877b293b1d7f8727a7de08ae36b6b9ef0", "deprecated": false, "id": "CVE-2025-39759-49d74128", "signature_type": "Function", "digest": { "length": 362.0, "function_hash": "174343197897657788131371271660849341946" }, "target": { "file": "fs/btrfs/qgroup.c", "function": "btrfs_free_qgroup_config" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7cda0fdde5d9890976861421d207870500f9aace", "deprecated": false, "id": "CVE-2025-39759-4f64a68b", "signature_type": "Function", "digest": { "length": 630.0, "function_hash": "61233328739820675524175455913134747625" }, "target": { "file": "fs/btrfs/qgroup.c", "function": "btrfs_qgroup_rescan" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2fd0f5ceb997f90f4332ccbab6c7e907e6b2d0eb", "deprecated": false, "id": "CVE-2025-39759-5caed070", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "328894255868628419985491678060298041696", "9290429690171501038012617916602840885", "68816336900351827422676550728881588148", "115953295919934257223536109224005989716", "167034228587438922520431199582604366025", "37708323274591759133317959039478996932", "233441703057455789339190334402070748029", "140739900538943747571219827843097951033", "60171144601634881558888121226614490698", "168800690081137798413475596819774497072", "11868222744778810127465168093382383387", "28496182084947518281671381050048256994", "321052024337669695824499613483407206472", "86269862336526427499921605407882812111", "154400376915613536302722070718865368639", "69813482124431495765144326648618833307", "299911309803003990132679690875921082990", "222516708497829389703196474976208353415", "240274697377155759180550718602132078626", "301554364136785712491517732044614705628", "102713636929448078772687489309959926112", "210808924914909072060079509539774897770" ] }, "target": { "file": "fs/btrfs/qgroup.c" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2fd0f5ceb997f90f4332ccbab6c7e907e6b2d0eb", "deprecated": false, "id": "CVE-2025-39759-6dc504d6", "signature_type": "Function", "digest": { "length": 362.0, "function_hash": "174343197897657788131371271660849341946" }, "target": { "file": "fs/btrfs/qgroup.c", "function": "btrfs_free_qgroup_config" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b172535ccba12f0cf7d23b3b840989de47fc104d", "deprecated": false, "id": "CVE-2025-39759-733e664a", "signature_type": "Function", "digest": { "length": 707.0, "function_hash": "89472660912078929597253479666855694535" }, "target": { "file": "fs/btrfs/qgroup.c", "function": "btrfs_qgroup_rescan" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c38028ce0d0045ca600b6a8345a0ff92bfb47b66", "deprecated": false, "id": "CVE-2025-39759-7557f460", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "328894255868628419985491678060298041696", "9290429690171501038012617916602840885", "68816336900351827422676550728881588148", "115953295919934257223536109224005989716", "167034228587438922520431199582604366025", "37708323274591759133317959039478996932", "233441703057455789339190334402070748029", "140739900538943747571219827843097951033", "60171144601634881558888121226614490698", "168800690081137798413475596819774497072", "11868222744778810127465168093382383387", "28496182084947518281671381050048256994", "321052024337669695824499613483407206472", "86269862336526427499921605407882812111", "154400376915613536302722070718865368639", "69813482124431495765144326648618833307", "299911309803003990132679690875921082990", "222516708497829389703196474976208353415", "240274697377155759180550718602132078626", "301554364136785712491517732044614705628", "102713636929448078772687489309959926112", "210808924914909072060079509539774897770" ] }, "target": { "file": "fs/btrfs/qgroup.c" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd0b28d877b293b1d7f8727a7de08ae36b6b9ef0", "deprecated": false, "id": "CVE-2025-39759-7b308914", "signature_type": "Function", "digest": { "length": 477.0, "function_hash": "111157964639942398852745695157840468936" }, "target": { "file": "fs/btrfs/qgroup.c", "function": "btrfs_qgroup_rescan" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e1249667750399a48cafcf5945761d39fa584edf", "deprecated": false, "id": "CVE-2025-39759-950529c8", "signature_type": "Function", "digest": { "length": 477.0, "function_hash": "111157964639942398852745695157840468936" }, "target": { "file": "fs/btrfs/qgroup.c", "function": "btrfs_qgroup_rescan" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e1249667750399a48cafcf5945761d39fa584edf", "deprecated": false, "id": "CVE-2025-39759-a1f3178c", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "328894255868628419985491678060298041696", "9290429690171501038012617916602840885", "68816336900351827422676550728881588148", "115953295919934257223536109224005989716", "167034228587438922520431199582604366025", "37708323274591759133317959039478996932", "233441703057455789339190334402070748029", "140739900538943747571219827843097951033", "60171144601634881558888121226614490698", "168800690081137798413475596819774497072", "11868222744778810127465168093382383387", "28496182084947518281671381050048256994", "321052024337669695824499613483407206472", "86269862336526427499921605407882812111", "154400376915613536302722070718865368639", "69813482124431495765144326648618833307", "299911309803003990132679690875921082990", "222516708497829389703196474976208353415", "240274697377155759180550718602132078626", "301554364136785712491517732044614705628", "102713636929448078772687489309959926112", "210808924914909072060079509539774897770" ] }, "target": { "file": "fs/btrfs/qgroup.c" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c38028ce0d0045ca600b6a8345a0ff92bfb47b66", "deprecated": false, "id": "CVE-2025-39759-acccae6c", "signature_type": "Function", "digest": { "length": 477.0, "function_hash": "111157964639942398852745695157840468936" }, "target": { "file": "fs/btrfs/qgroup.c", "function": "btrfs_qgroup_rescan" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7cda0fdde5d9890976861421d207870500f9aace", "deprecated": false, "id": "CVE-2025-39759-e61f6698", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "328894255868628419985491678060298041696", "9290429690171501038012617916602840885", "68816336900351827422676550728881588148", "115953295919934257223536109224005989716", "167034228587438922520431199582604366025", "37708323274591759133317959039478996932", "233441703057455789339190334402070748029", "78020937040465590139266257890792392337", "86761414641883622302834203545052945798", "78743369407073694434501353745230037905", "66110886832303203769274733577773993857", "28496182084947518281671381050048256994", "321052024337669695824499613483407206472", "86269862336526427499921605407882812111", "154400376915613536302722070718865368639", "69813482124431495765144326648618833307", "299911309803003990132679690875921082990", "222516708497829389703196474976208353415", "240274697377155759180550718602132078626", "301554364136785712491517732044614705628", "102713636929448078772687489309959926112", "210808924914909072060079509539774897770" ] }, "target": { "file": "fs/btrfs/qgroup.c" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b172535ccba12f0cf7d23b3b840989de47fc104d", "deprecated": false, "id": "CVE-2025-39759-e67d9e47", "signature_type": "Function", "digest": { "length": 370.0, "function_hash": "293621817430732535774513386425523227202" }, "target": { "file": "fs/btrfs/qgroup.c", "function": "btrfs_free_qgroup_config" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7cda0fdde5d9890976861421d207870500f9aace", "deprecated": false, "id": "CVE-2025-39759-f3cc6283", "signature_type": "Function", "digest": { "length": 370.0, "function_hash": "293621817430732535774513386425523227202" }, "target": { "file": "fs/btrfs/qgroup.c", "function": "btrfs_free_qgroup_config" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c38028ce0d0045ca600b6a8345a0ff92bfb47b66", "deprecated": false, "id": "CVE-2025-39759-ffe21760", "signature_type": "Function", "digest": { "length": 362.0, "function_hash": "174343197897657788131371271660849341946" }, "target": { "file": "fs/btrfs/qgroup.c", "function": "btrfs_free_qgroup_config" } } ] }