CVE-2025-21753

Summary

CVE-2025-21753 is a vulnerability affecting the Linux kernel's btrfs file system. It involves a use-after-free issue where, during a transaction join operation, the system may read the 'aborted' field of a transaction without holding the appropriate lock. If a concurrent task aborts the transaction before it's read, it can lead to a use-after-free scenario. This vulnerability was identified by syzbot and Dmitry and was fixed by reading the 'aborted' field while holding fs_info->trans_lock to ensure proper synchronization. The issue was reported through stack traces from KASAN, with affected functions including join_transaction, start_transaction, and btrfs_async_reclaim_data_space.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.