CVE-2025-21879

Summary

CVE-2025-21879 is a use-after-free vulnerability affecting the Linux kernel's btrfs file system. Specifically, during the shrinking process of a Btrfs filesystem, the function btrfs_scan_root() accesses the inode's root and fs_info after scheduling the inode for a delayed iput. This sequence of events can lead to a use-after-free on the inode if the cleaner kthread performs the iput before the function dereferences the inode in the call to btrfs_fs_closing(). The issue is resolved by utilizing the fs_info stored in a local variable instead of accessing it through the inode's root.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.