CVE-2025-21753: Linux Kernel Use-After-Free Vulnerability

CVE-2025-21753 Overview

CVE-2025-21753 is a use-after-free vulnerability [CWE-416] in the Btrfs filesystem code of the Linux kernel. The flaw resides in the join_transaction() function in fs/btrfs/transaction.c. When a task attempts to join the current transaction and that transaction is aborted, the kernel reads the transaction's aborted field after releasing fs_info->trans_lock and without holding an extra reference. A concurrent task that frees the transaction can race with this read, producing a use-after-free condition. The bug was reported by syzbot and Dmitry, with KASAN providing the slab-use-after-free stack traces.

Critical Impact
Local attackers with the ability to trigger Btrfs transaction operations can corrupt kernel memory, potentially escalating privileges or crashing the system.

Affected Products

Linux Kernel multiple stable branches prior to the fix commits
Linux Kernel 6.14-rc1
Distributions shipping vulnerable Btrfs code, including Debian (per Debian LTS advisories) and Siemens products (per SSA-265688)

Discovery Timeline

2025-02-27 - CVE-2025-21753 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2025-21753

Vulnerability Analysis

The defect is a classic race-induced use-after-free in the Btrfs transaction subsystem. In join_transaction() at fs/btrfs/transaction.c:278, the kernel checks whether the running transaction has been aborted by reading cur_trans->aborted. The original code released fs_info->trans_lock before this read and did not take an additional reference on the transaction. A concurrent cleanup_transaction() path, invoked from btrfs_commit_transaction(), can kfree() the transaction object between the unlock and the field read.

KASAN reports confirm the pattern: allocation occurs in join_transaction+0x144/0xda0 via kmalloc, the object is freed by kfree+0x196/0x430 in cleanup_transaction, and a later reader at join_transaction+0xd9b/0xda0 accesses the freed slab object. The reader runs in the btrfs_async_reclaim_data_space workqueue context.

The upstream fix relocates the aborted field read to occur while fs_info->trans_lock is still held. Any task freeing the transaction must first acquire that lock and set fs_info->running_transaction to NULL, so holding the lock during the read prevents the race.

Root Cause

The root cause is missing synchronization between transaction join and transaction cleanup. The original logic assumed it was safe to inspect the transaction after dropping the protecting spinlock, but the freeing path acquires the same lock to detach the transaction and then releases the memory. Without a reference count or lock-protected read, the join path operates on a dangling pointer.

Attack Vector

Exploitation requires local access and the ability to perform Btrfs filesystem operations that trigger transaction aborts, such as balance operations, snapshot creation, or other actions that exercise btrfs_commit_transaction() and the async reclaim worker. A local attacker who can race transaction abort against concurrent filesystem activity may achieve memory corruption in kernel context. The vulnerability does not require user interaction. See the Linux kernel commit fixing the race for the precise code change.

Detection Methods for CVE-2025-21753

Indicators of Compromise

KASAN reports referencing slab-use-after-free in join_transaction at fs/btrfs/transaction.c:278
Kernel oops or panic traces involving join_transaction, start_transaction, and btrfs_async_reclaim_data_space
Unexpected Btrfs transaction abort messages in dmesg accompanied by worker thread crashes

Detection Strategies

Inventory hosts running Btrfs and compare running kernel versions against the fixed stable commits listed in the kernel.org advisories
Enable KASAN on test and staging kernels to surface the use-after-free during fuzzing or stress testing of Btrfs workloads
Monitor kernel logs for repeated Btrfs transaction abort events that precede crashes

Monitoring Recommendations

Forward kernel and dmesg logs to a centralized logging or SIEM platform and alert on BUG: KASAN, general protection fault, and Oops patterns referencing btrfs
Track Btrfs balance, snapshot, and reclaim activity on multi-tenant systems where local users can trigger transaction operations
Audit workloads that execute btrfs balance or heavy concurrent I/O on shared systems

How to Mitigate CVE-2025-21753

Immediate Actions Required

Apply the stable kernel update that includes the Btrfs transaction join fix on all Linux hosts using Btrfs
Patch Debian systems using the updates from Debian LTS DLA March 2025 and Debian LTS DLA May 2025
Patch affected Siemens products per Siemens SSA-265688
Restrict local user accounts on systems where untrusted users can trigger Btrfs operations

Patch Information

The fix is upstream in the Linux kernel and backported to multiple stable branches. Reference the commits at kernel.org commit cee55b1, commit 8f5cff4, commit 7e954b6, commit 86d71a0, commit c7a5375, commit ce62804, commit e2f0943, and commit 6ba4663. The fix moves the read of cur_trans->aborted inside the fs_info->trans_lock critical section.

Workarounds

Where patching is delayed, limit local shell access and remove Btrfs operation privileges from non-administrative accounts
Avoid running workloads that trigger frequent transaction aborts, such as aggressive balance operations on near-full filesystems
Consider migrating critical workloads to a non-Btrfs filesystem on unpatched long-lived systems until kernel updates are deployed

bash

# Verify running kernel and Btrfs filesystem presence
uname -r
mount -t btrfs
# Example: update kernel on Debian-based systems
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | sed 's/.*-//')
sudo reboot