CVE-2025-38034: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38034 is a NULL pointer dereference vulnerability in the Linux kernel's btrfs filesystem subsystem, specifically in the btrfs_prelim_ref() tracing function. The bug arises from incorrect argument ordering when calling trace_btrfs_prelim_ref_insert(), where oldref is passed as NULL instead of the intended newref value. It was published on June 18, 2025, and affects Linux kernel versions from 5.4 through 6.14.x (prior to their respective stable fixes), as well as Debian Linux 11.0. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is classified as CWE-476 (NULL Pointer Dereference). In btrfs_prelim_ref(), the oldref and newref arguments are passed in the wrong order to trace_btrfs_prelim_ref_insert(), causing the function to dereference a NULL pointer when btrfs tracing is enabled. The fault is triggered locally by a low-privileged user who can initiate writeback operations on a btrfs filesystem while the btrfs_prelim_ref_insert tracepoint is active (enabled via /sys/kernel/debug/tracing/events/btrfs/btrfs_prelim_ref_insert/enable). The kernel oops occurs at trace_event_raw_event_btrfs__prelim_ref+0x72 when it attempts to read from address 0x0000000000000018 (Feedly).

Successful exploitation causes a kernel NULL pointer dereference (BUG/Oops), resulting in a system crash and denial of service. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Systems running btrfs filesystems with kernel tracing enabled are at risk of unexpected crashes during writeback operations, which could lead to data unavailability or filesystem inconsistency if the crash occurs mid-operation (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability requires local access with low privileges and is only triggerable when the btrfs btrfs_prelim_ref_insert tracepoint is explicitly enabled, limiting its practical attack surface. The EPSS score is 0.024% (very low), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

1. Gain local access: Obtain a low-privileged local account on a system running a vulnerable Linux kernel version with a btrfs filesystem mounted.
2. Enable btrfs tracing: Execute echo 1 > /sys/kernel/debug/tracing/events/btrfs/btrfs_prelim_ref_insert/enable (requires access to debugfs, typically root or CAP_SYS_ADMIN).
3. Trigger writeback: Initiate filesystem writeback operations on the btrfs volume (e.g., using fsstress or by writing and syncing files), which causes btrfs_prelim_ref_insert to be called.
4. Kernel crash: The NULL pointer dereference in trace_event_raw_event_btrfs__prelim_ref triggers a kernel oops/panic, crashing the system (Feedly).

• Logs: Kernel oops messages referencing trace_event_raw_event_btrfs__prelim_ref+0x72/0x130 and BUG: kernel NULL pointer dereference, address: 0000000000000018 in /var/log/kern.log or dmesg output.
• Logs: Stack traces involving fsstress or other btrfs writeback processes in kernel crash logs.
• File System: Presence of enabled tracepoint at /sys/kernel/debug/tracing/events/btrfs/btrfs_prelim_ref_insert/enable containing 1.
• Process: Unexpected system reboots or kernel panics on systems with btrfs mounts and tracing enabled (Feedly).

Patches have been released for all affected stable kernel branches: upgrade to 5.4.294, 5.10.238, 5.15.185, 6.1.141, 6.6.93, 6.12.31, or 6.14.9 or later. As an immediate workaround, disable btrfs tracing by ensuring the btrfs_prelim_ref_insert tracepoint is not enabled (echo 0 > /sys/kernel/debug/tracing/events/btrfs/btrfs_prelim_ref_insert/enable). Downstream distributions including Debian (DSA-5973-1, DLA-4327-1), Ubuntu (USN-7704, USN-7712, USN-7769, USN-7770, USN-7771, USN-7789), SUSE, and Oracle Linux have issued updated kernel packages (Feedly, Ubuntu Advisory, Debian LTS).