CVE-2025-38269

MEDIUM

Linux Kernel - NULL Pointer Dereference in btrfs_convert_extent_bit

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: exit after state insertion failure at btrfs_convert_extent_bit() If insert_state() state failed it returns an error pointer and we call extent_io_tree_panic() which will trigger a BUG() call. However if CONFIG_BUG is disabled, which is an uncommon and exotic scenario, then we fallthrough and call cache_state() which will dereference the error pointer, resulting in an invalid memory access. So jump to the 'out' label after calling extent_io_tree_panic(), it also makes the code more clear besides dealing with the exotic scenario where CONFIG_BUG is disabled.

Scores

CVSS v3 5.5
EPSS 0.0015
EPSS Percentile 4.8%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

CWE
CWE-476
Status published
Products (11)
linux/Kernel 6.13.0 - 6.15.3linux
linux/Kernel 6.7.0 - 6.12.34linux
Linux/Linux < 6.7
Linux/Linux 6.12.34 - 6.12.*
Linux/Linux 6.15.3 - 6.15.*
Linux/Linux 6.16
Linux/Linux 6.7
Linux/Linux c91ea4bfa6dda549295ea7c15dfc990094d1fcd3 - 3bf179e36da917c5d9bec71c714573ed1649b7c1
Linux/Linux c91ea4bfa6dda549295ea7c15dfc990094d1fcd3 - 58c50f45e1821a04d61b62514f9bd34afe67c622
Linux/Linux c91ea4bfa6dda549295ea7c15dfc990094d1fcd3 - 8d9d32088e304e2bc444a3087cab0bbbd9951866
... and 1 more
Published Jul 10, 2025
Tracked Since Feb 18, 2026