Log in Start free

Vulnerability · Published Jun 18, 2025 · Assigned by Linux

CVE-2025-38059btrfs: avoid NULL pointer dereference if no valid csum tree

Medium 5.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.2%top 90.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid NULL pointer dereference if no valid csum tree [BUG] When trying read-only scrub on a btrfs with rescue=idatacsums mount option, it will crash with the following call trace: BUG: kernel NULL pointer dereference, address: 0000000000000208 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page CPU: 1 UID: 0 PID: 835 Comm: btrfs Tainted: G O 6.15.0-rc3-custom+ #236 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022 RIP: 0010:btrfs_lookup_csums_bitmap+0x49/0x480 [btrfs] Call Trace: <TASK> scrub_find_fill_first_stripe+0x35b/0x3d0 [btrfs] scrub_simple_mirror+0x175/0x290 [btrfs] scrub_stripe+0x5f7/0x6f0 [btrfs] scrub_chunk+0x9a/0x150 [btrfs] scrub_enumerate_chunks+0x333/0x660 [btrfs] btrfs_scrub_dev+0x23e/0x600 [btrfs] btrfs_ioctl+0x1dcf/0x2f80 [btrfs] __x64_sys_ioctl+0x97/0xc0 do_syscall_64+0x4f/0x120 entry_SYSCALL_64_after_hwframe+0x76/0x7e [CAUSE] Mount option "rescue=idatacsums" will completely skip loading the csum tree, so that any data read will not find any data csum thus we will ignore data checksum verification. Normally call sites utilizing csum tree will check the fs state flag NO_DATA_CSUMS bit, but unfortunately scrub does not check that bit at all. This results in scrub to call btrfs_search_slot() on a NULL pointer and triggered above crash. [FIX] Check both extent and csum tree root before doing any tree search.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linuxno fix listedDEBIAN-CVE-2025-38059
Debian:13linux6.12.32-1DEBIAN-CVE-2025-38059
Debian:14linux6.12.32-1DEBIAN-CVE-2025-38059
Ubuntu:22.04:LTSlinuxno fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux6.8.0-100.100UBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-awsno fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-aws6.8.0-1046.49UBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-aws-6.146.14.0-1013.13~24.04.1USN-7769-3
Ubuntu:24.04:LTSlinux-aws-6.146.14.0-1013.13~24.04.1UBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1046.49~22.04.1UBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-azureno fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-azure6.8.0-1046.52UBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1051.57~22.04.1UBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-azure-fde6.8.0-1046.53UBUNTU-CVE-2025-38059
Ubuntu:25.10linux-azure-fdeno fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-azure-fde-6.86.8.0-1046.53~22.04.1UBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-azure-nvidiano fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-azure-nvidia-6.146.14.0-1007.7UBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-gcpno fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-gcp6.8.0-1047.50UBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-gcp-6.146.14.0-1016.17~24.04.1UBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-gcp-6.146.14.0-1016.17~24.04.1USN-7769-1
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1047.50~22.04.2UBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-gkeno fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-gke6.8.0-1043.48UBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-gkeopno fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1030.33UBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-hwe-6.146.14.0-32.32~24.04.1USN-7769-3
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-100.100~22.04.1UBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-ibmno fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-ibm6.8.0-1044.44UBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1044.44~22.04.1UBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-intelno fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-intel-iotgno fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-kvmno fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-lowlatencyno fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-100.100.1UBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-100.100.1~22.04.1UBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1046.49UBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1046.49~22.04.1UBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1046.49.1UBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-nvidia-tegrano fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1020.20UBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-nvidia-tegra-igxno fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-oem-6.146.14.0-1012.12UBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-oem-6.146.14.0-1012.12USN-7771-1
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-oracleno fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-oracle6.8.0-1043.44UBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-oracle-6.146.14.0-1013.13~24.04.1USN-7789-1
Ubuntu:24.04:LTSlinux-oracle-6.146.14.0-1013.13~24.04.1UBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1043.44~22.04.1UBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-raspino fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-raspi6.8.0-1047.51UBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-riscv-6.146.14.0-32.32.1~24.04.1UBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-100.100~22.04.1UBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2025-38059
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1023.24UBUNTU-CVE-2025-38059
Ubuntu:22.04:LTSlinux-xilinx-zynqmpno fix listedUBUNTU-CVE-2025-38059

Affected products (as reported)

VendorProductVersions
Linux Linux 74ef00185eb864252156022ff129b01549504175 – before 2db25048a61c0909459b074af04e06ab8a8b939e74ef00185eb864252156022ff129b01549504175 – before 50d0de59f66cbe6d597481e099bf1c70fd07e0a974ef00185eb864252156022ff129b01549504175 – before 6e9770de024964b1017f99ee94f71967bd6edaeb74ef00185eb864252156022ff129b01549504175 – before d35bed14b0bc95c6845863a3744ecd10b888c83074ef00185eb864252156022ff129b01549504175 – before f95d186255b319c48a365d47b69bd997fecb674e
Linux Linux 5.9

References