CVE-2025-38269
MEDIUMLinux Kernel - NULL Pointer Dereference in btrfs_convert_extent_bit
Title source: llmDescription
In the Linux kernel, the following vulnerability has been resolved: btrfs: exit after state insertion failure at btrfs_convert_extent_bit() If insert_state() state failed it returns an error pointer and we call extent_io_tree_panic() which will trigger a BUG() call. However if CONFIG_BUG is disabled, which is an uncommon and exotic scenario, then we fallthrough and call cache_state() which will dereference the error pointer, resulting in an invalid memory access. So jump to the 'out' label after calling extent_io_tree_panic(), it also makes the code more clear besides dealing with the exotic scenario where CONFIG_BUG is disabled.
References (3)
Core 3
Scores
CVSS v3
5.5
EPSS
0.0015
EPSS Percentile
4.8%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-476
Status
published
Products (11)
linux/Kernel
6.13.0 - 6.15.3linux
linux/Kernel
6.7.0 - 6.12.34linux
Linux/Linux
< 6.7
Linux/Linux
6.12.34 - 6.12.*
Linux/Linux
6.15.3 - 6.15.*
Linux/Linux
6.16
Linux/Linux
6.7
Linux/Linux
c91ea4bfa6dda549295ea7c15dfc990094d1fcd3 - 3bf179e36da917c5d9bec71c714573ed1649b7c1
Linux/Linux
c91ea4bfa6dda549295ea7c15dfc990094d1fcd3 - 58c50f45e1821a04d61b62514f9bd34afe67c622
Linux/Linux
c91ea4bfa6dda549295ea7c15dfc990094d1fcd3 - 8d9d32088e304e2bc444a3087cab0bbbd9951866
... and 1 more
Published
Jul 10, 2025
Tracked Since
Feb 18, 2026