CVE-2025-40209

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation When btrfs_add_qgroup_relation() is called with invalid qgroup levels (src >= dst), the function returns -EINVAL directly without freeing the preallocated qgroup_list structure passed by the caller. This causes a memory leak because the caller unconditionally sets the pointer to NULL after the call, preventing any cleanup. The issue occurs because the level validation check happens before the mutex is acquired and before any error handling path that would free the prealloc pointer. On this early return, the cleanup code at the 'out' label (which includes kfree(prealloc)) is never reached. In btrfs_ioctl_qgroup_assign(), the code pattern is: prealloc = kzalloc(sizeof(*prealloc), GFP_KERNEL); ret = btrfs_add_qgroup_relation(trans, sa->src, sa->dst, prealloc); prealloc = NULL; // Always set to NULL regardless of return value ... kfree(prealloc); // This becomes kfree(NULL), does nothing When the level check fails, 'prealloc' is never freed by either the callee or the caller, resulting in a 64-byte memory leak per failed operation. This can be triggered repeatedly by an unprivileged user with access to a writable btrfs mount, potentially exhausting kernel memory. Fix this by freeing prealloc before the early return, ensuring prealloc is always freed on all error paths.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Deferred

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2025-11-21 11:15:47

Last modified

2026-10-19 19:10:00.130000

View original CVE JSON

{
  "id": "CVE-2025-40209",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-11-21T11:15:47.000",
  "lastModified": "2026-10-19T19:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation\n\nWhen btrfs_add_qgroup_relation() is called with invalid qgroup levels\n(src >= dst), the function returns -EINVAL directly without freeing the\npreallocated qgroup_list structure passed by the caller. This causes a\nmemory leak because the caller unconditionally sets the pointer to NULL\nafter the call, preventing any cleanup.\n\nThe issue occurs because the level validation check happens before the\nmutex is acquired and before any error handling path that would free\nthe prealloc pointer. On this early return, the cleanup code at the\n'out' label (which includes kfree(prealloc)) is never reached.\n\nIn btrfs_ioctl_qgroup_assign(), the code pattern is:\n\n    prealloc = kzalloc(sizeof(*prealloc), GFP_KERNEL);\n    ret = btrfs_add_qgroup_relation(trans, sa->src, sa->dst, prealloc);\n    prealloc = NULL;  // Always set to NULL regardless of return value\n    ...\n    kfree(prealloc);  // This becomes kfree(NULL), does nothing\n\nWhen the level check fails, 'prealloc' is never freed by either the\ncallee or the caller, resulting in a 64-byte memory leak per failed\noperation. This can be triggered repeatedly by an unprivileged user\nwith access to a writable btrfs mount, potentially exhausting kernel\nmemory.\n\nFix this by freeing prealloc before the early return, ensuring prealloc\nis always freed on all error paths."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbtrfs: corrige la fuga de memoria de qgroup_list en btrfs_add_qgroup_relation\n\nCuando se llama a btrfs_add_qgroup_relation() con niveles de qgroup inválidos (src >= dst), la función devuelve -EINVAL directamente sin liberar la estructura qgroup_list preasignada pasada por el llamador. Esto causa una fuga de memoria porque el llamador establece incondicionalmente el puntero en NULL después de la llamada, impidiendo cualquier limpieza.\n\nEl problema ocurre porque la comprobación de validación de nivel sucede antes de que se adquiera el mutex y antes de cualquier ruta de manejo de errores que liberaría el puntero prealloc. En este retorno temprano, el código de limpieza en la etiqueta 'out' (que incluye kfree(prealloc)) nunca se alcanza.\n\nEn btrfs_ioctl_qgroup_assign(), el patrón de código es:\n\n    prealloc = kzalloc(sizeof(prealloc), GFP_KERNEL);\n    ret = btrfs_add_qgroup_relation(trans, sa -> src, sa -> dst, prealloc);\n    prealloc = NULL; // Siempre se establece en NULL independientemente del valor de retorno\n    ...\n    kfree(prealloc); // Esto se convierte en kfree(NULL), no hace nada\n\nCuando la comprobación de nivel falla, 'prealloc' nunca es liberado ni por el llamado ni por el llamador, lo que resulta en una fuga de memoria de 64 bytes por operación fallida. Esto puede ser activado repetidamente por un usuario sin privilegios con acceso a un montaje btrfs escribible, agotando potencialmente la memoria del kernel.\n\nSolucione esto liberando prealloc antes del retorno temprano, asegurando que prealloc siempre se libere en todas las rutas de error."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "fs/btrfs/qgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "4addc1ffd67ad34394674dc91379dc04cfdd2537",
              "lessThan": "3412d0e973e8f8381747d69033eda809a57a2581",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "4addc1ffd67ad34394674dc91379dc04cfdd2537",
              "lessThan": "a4d9ebe23bcb79d9d057e3c995db73b7b3aae414",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "4addc1ffd67ad34394674dc91379dc04cfdd2537",
              "lessThan": "f260c6aff0b8af236084012d14f9f1bf792ea883",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "fs/btrfs/qgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.11",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.11",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.58",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.17.8",
              "lessThanOrEqual": "6.17.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/3412d0e973e8f8381747d69033eda809a57a2581",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a4d9ebe23bcb79d9d057e3c995db73b7b3aae414",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f260c6aff0b8af236084012d14f9f1bf792ea883",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}