CVE-2025-21879
Published: 27 March 2025
Summary
CVE-2025-21879 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 8.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2025-21879 is a use-after-free vulnerability in the Linux kernel's BTRFS filesystem. The issue arises in the btrfs_scan_root() function during extent map (em) shrinking, where the code accesses the inode's root and fs_info via a call to btrfs_fs_closing() after scheduling the inode for a delayed iput. This can lead to a use-after-free if the cleaner kthread performs the iput before the dereference completes. The vulnerability is classified under CWE-416 with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of user interaction requirements. Successful exploitation could result in high impacts to confidentiality, integrity, and availability, potentially allowing arbitrary code execution, data corruption, or system crashes within the context of the BTRFS operations.
Mitigation involves applying the upstream kernel patches referenced in the stable repository commits: 07836bc18f4ae42da4e922244f4685561c18755e, 59f37036bb7ab3d554c24abc856aabca01126414, and 5e79d26014f9386387575b9ed60d342057cee49b. The fix modifies btrfs_scan_root() to use a locally stored fs_info variable instead of accessing it through inode->root->fs_info, preventing the use-after-free. Security practitioners should update affected Linux kernels promptly, particularly those using BTRFS.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8487
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free on inode when scanning root during em shrinking At btrfs_scan_root() we are accessing the inode's root (and fs_info) in a call to btrfs_fs_closing() after we have scheduled…
more
the inode for a delayed iput, and that can result in a use-after-free on the inode in case the cleaner kthread does the iput before we dereference the inode in the call to btrfs_fs_closing(). Fix this by using the fs_info stored already in a local variable instead of doing inode->root->fs_info.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Linux kernel BTRFS enables local arbitrary code execution and privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, and patching of flaws such as the use-after-free in BTRFS kernel code.
Enables vulnerability scanning to identify the presence of CVE-2025-21879 in deployed Linux kernels using BTRFS.
Provides memory protections like ASLR and non-executable memory to mitigate exploitation of the use-after-free vulnerability.