Riskcovery

CVE-2025-38269

btrfs: exit after state insertion failure at btrfs_convert_extent_bit()

State
Published
Severity
Not scored
Published
Jul 10, 2025
Updated
May 11, 2026
Reserved
Apr 16, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: exit after state insertion failure at btrfs_convert_extent_bit()

If insert_state() state failed it returns an error pointer and we call extent_io_tree_panic() which will trigger a BUG() call. However if CONFIG_BUG is disabled, which is an uncommon and exotic scenario, then we fallthrough and call cache_state() which will dereference the error pointer, resulting in an invalid memory access.

So jump to the 'out' label after calling extent_io_tree_panic(), it also makes the code more clear besides dealing with the exotic scenario where CONFIG_BUG is disabled.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • c91ea4bfa6dda549295ea7c15dfc990094d1fcd3 to before 58c50f45e1821a04d61b62514f9bd34afe67c622Affected
  • c91ea4bfa6dda549295ea7c15dfc990094d1fcd3 to before 8d9d32088e304e2bc444a3087cab0bbbd9951866Affected
  • c91ea4bfa6dda549295ea7c15dfc990094d1fcd3 to before 3bf179e36da917c5d9bec71c714573ed1649b7c1Affected
LinuxLinux
  • 6.7Affected
  • before 6.7Not affected
  • 6.12.34 through 6.12.*Not affected
  • 6.15.3 through 6.15.*Not affected
  • 6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.