CVE-2025-22115: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-22115 is a vulnerability discovered in the Linux kernel's BTRFS filesystem implementation, specifically related to a block group refcount race condition in the btrfs_create_pending_block_groups() function. The vulnerability was disclosed on April 16, 2025, affecting systems using the BTRFS filesystem (NVD, RedHat).

The vulnerability stems from a race condition in the two-phase block group creation process. The issue occurs when a block group can be allocated/deallocated after btrfs_make_block_group() adds it to the space_info with btrfs_add_bg_to_space_info(), but before creation is completed in btrfs_create_pending_block_groups(). This can lead to concurrent execution of btrfs_mark_bg_unused and btrfs_create_pending_block_groups, resulting in broken reference counts and invalid new_bgs state for transaction cleanup. The vulnerability has been assigned a CVSS v3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) (RedHat).

The vulnerability can result in reference count underflow and use-after-free conditions in the Linux kernel's BTRFS filesystem. This primarily manifests as system warnings and potential filesystem integrity issues, particularly after relocation operations that cancel discard and tear down block groups (NVD).

The vulnerability requires local access and can be triggered through filesystem operations involving BTRFS block group management. It is most likely to occur after a relocation operation finishes which cancels discard and tears down block groups (RedHat).

The vulnerability has been resolved in various Linux distributions. Debian has marked this as fixed in bullseye version 5.10.234-1, while it remains vulnerable in bookworm and trixie releases. The fix involves properly handling the lock mechanism around block group operations (Debian).