CVE-2025-21753: Linux Kernel Use-After-Free Vulnerability

CVE-2025-21753 Overview

CVE-2025-21753 is a use-after-free vulnerability in the Linux kernel's Btrfs filesystem subsystem. The flaw exists in the transaction handling code, specifically in the join_transaction function located in fs/btrfs/transaction.c. When attempting to join an aborted transaction, the kernel reads the transaction's aborted field after releasing the fs_info->trans_lock spinlock without holding an additional reference count on the transaction object. This race condition allows a concurrent task that is aborting the transaction to free the transaction structure before the aborted field is read, resulting in a use-after-free condition.

Critical Impact

This vulnerability enables local attackers with low privileges to potentially achieve privilege escalation or cause system crashes through memory corruption in kernel space. The use-after-free condition can lead to arbitrary code execution in kernel context.

Affected Products

• Linux Kernel (multiple versions affected)
• Linux Kernel version 6.14-rc1
• Systems using Btrfs filesystem with active transaction operations

Discovery Timeline

• 2025-02-27 - CVE-2025-21753 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-21753

Vulnerability Analysis

The vulnerability resides in the Btrfs transaction management subsystem within the Linux kernel. When a process attempts to join an existing transaction via the join_transaction function, it acquires the fs_info->trans_lock spinlock to access the current running transaction. However, after releasing this lock, the code continues to access the transaction's aborted field without maintaining a reference count on the transaction object.

This creates a classic time-of-check-time-of-use (TOCTOU) race condition. A concurrent task performing transaction abort and cleanup can acquire the lock, set fs_info->running_transaction to NULL, and subsequently free the transaction memory through cleanup_transaction and btrfs_commit_transaction. When the original task then attempts to read the aborted field at memory offset 0x24 (as seen in the KASAN report at address ffff888011839024), it accesses freed memory.

The vulnerability was identified through kernel address sanitizer (KASAN) testing, which detected a slab-use-after-free read of 4 bytes in join_transaction+0xd9b at line 278 of transaction.c. The affected code path is triggered through various Btrfs operations including btrfs_async_reclaim_data_space, file creation operations, and balance operations.

Root Cause

The root cause is insufficient synchronization in the transaction joining code path. The aborted field access occurs outside the critical section protected by fs_info->trans_lock, violating the expected locking discipline. The transaction lifecycle management requires that any access to transaction fields must either hold the transaction lock or maintain a reference count to prevent premature deallocation.

The fix ensures that the aborted field is read while still holding fs_info->trans_lock, since any task freeing the transaction must first acquire that lock and set fs_info->running_transaction to NULL before proceeding with the free operation.

Attack Vector

The attack vector is local and requires low privileges to exploit. An attacker with the ability to execute code on the target system can trigger this vulnerability by:

1. Initiating Btrfs filesystem operations that create or join transactions
2. Triggering transaction abort conditions while concurrent transaction join operations are in progress
3. Racing the transaction cleanup against the transaction join to exploit the use-after-free window

The vulnerability can be triggered through the btrfs_async_reclaim_data_space workqueue handler, file creation via btrfs_create_common, or balance operations through btrfs_balance. Successful exploitation could lead to kernel memory corruption, privilege escalation, or denial of service through kernel panic.

Detection Methods for CVE-2025-21753

Indicators of Compromise

• Kernel panic or oops messages referencing join_transaction or fs/btrfs/transaction.c
• KASAN reports indicating slab-use-after-free in Btrfs transaction code paths
• System crashes during heavy Btrfs filesystem operations or balance operations
• Unexpected kernel memory corruption symptoms on systems with Btrfs filesystems

Detection Strategies

• Enable kernel address sanitizer (KASAN) to detect use-after-free conditions in production or testing environments
• Monitor kernel logs for Btrfs-related warnings, errors, or panic traces mentioning transaction handling
• Deploy runtime kernel integrity monitoring to detect anomalous memory access patterns
• Implement audit logging for Btrfs mount and balance operations to track potential exploitation attempts

Monitoring Recommendations

• Configure centralized log collection for kernel messages with alerting on Btrfs transaction errors
• Monitor system stability metrics on hosts using Btrfs filesystems
• Implement process monitoring for unusual Btrfs-related system calls or ioctl patterns
• Deploy SentinelOne Singularity agent for real-time kernel threat detection and behavioral analysis

How to Mitigate CVE-2025-21753

Immediate Actions Required

• Apply the official Linux kernel patches from the stable kernel tree immediately
• Prioritize patching systems actively using Btrfs filesystems in production environments
• Consider temporarily migrating critical workloads to ext4 or XFS filesystems if immediate patching is not possible
• Restrict local user access on affected systems to reduce attack surface

Patch Information

The Linux kernel maintainers have released patches across multiple stable kernel branches. The fix modifies the join_transaction function to read the aborted field while holding fs_info->trans_lock, ensuring proper synchronization with transaction cleanup operations.

Official patches are available through the following kernel git commits:

• Kernel Git Commit 6ba4663
• Kernel Git Commit 7e954b6
• Kernel Git Commit 86d71a0
• Kernel Git Commit 8f5cff4

Debian users should refer to the Debian LTS Announcement (March 2025) and Debian LTS Announcement (May 2025) for distribution-specific updates.

Workarounds

• Limit local user access on systems with Btrfs filesystems to trusted accounts only
• Reduce concurrent Btrfs operations that could trigger transaction race conditions
• Monitor and restrict heavy balance or data reclaim operations on production systems
• Consider unmounting non-essential Btrfs filesystems until patches can be applied

# Check current kernel version and Btrfs usage
uname -r
mount | grep btrfs

# Update to patched kernel on Debian-based systems
sudo apt update
sudo apt upgrade linux-image-$(uname -r | sed 's/-[^-]*$//')

# Verify kernel update and reboot
sudo reboot