CVE-2025-21879

CVE-2025-21879 is a use-after-free vulnerability in the Linux kernel's BTRFS filesystem. The issue arises in the btrfs_scan_root() function during extent map (em) shrinking, where the code accesses the inode's root and fs_info via a call to btrfs_fs_closing() after scheduling the inode for a delayed iput. This can lead to a use-after-free if the cleaner kthread performs the iput before the dereference completes. The vulnerability is classified under CWE-416 with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of user interaction requirements. Successful exploitation could result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution, data corruption, or system crashes within the context of the BTRFS operations.

Mitigation involves applying the upstream kernel patches referenced in the stable repository commits: 07836bc18f4ae42da4e922244f4685561c18755e, 59f37036bb7ab3d554c24abc856aabca01126414, and 5e79d26014f9386387575b9ed60d342057cee49b. The fix modifies btrfs_scan_root() to use a locally stored fs_info variable instead of accessing it through inode->root->fs_info, preventing the use-after-free. Security practitioners should update affected Linux kernels promptly, particularly those using BTRFS.