CVE-2025-38059: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38059 is a NULL pointer dereference vulnerability in the Linux kernel's Btrfs filesystem subsystem, triggered during read-only scrub operations when the rescue=idatacsums mount option is active. The flaw causes a kernel crash because the scrub code path does not check the NO_DATA_CSUMS filesystem state flag before attempting to access the checksum tree, which is not loaded under this mount option. Affected kernel versions span from 5.9 up to (but not including) 6.6.93, 6.7 through 6.12.30, 6.13 through 6.14.8, and 6.15-rc1 through rc5. It was published on June 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a missing guard in the Btrfs scrub code path (CWE-476: NULL Pointer Dereference). When a Btrfs filesystem is mounted with rescue=idatacsums, the kernel intentionally skips loading the checksum (csum) tree so that data reads proceed without checksum verification. However, the scrub_find_fill_first_stripe() function calls btrfs_lookup_csums_bitmap() without first checking the NO_DATA_CSUMS filesystem state flag, resulting in a dereference of a NULL pointer at offset 0x208 within the uninitialized csum tree root. The crash is locally triggerable by any user with sufficient privileges to invoke the BTRFS_IOC_SCRUB ioctl on a filesystem mounted with the affected option. Patches are available in the stable kernel tree (Feedly, Kernel Patch 1).

Successful exploitation causes an immediate kernel NULL pointer dereference, crashing the affected system and resulting in a denial of service (DoS). There is no confidentiality or integrity impact — the vulnerability is limited to availability, as the kernel panic renders the system unresponsive and requires a reboot. The scope is confined to the local system; lateral movement or data exfiltration are not applicable to this vulnerability (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The vulnerability requires local access with low privileges (sufficient to invoke the scrub ioctl) and a Btrfs filesystem mounted with the rescue=idatacsums option, which is a non-default, recovery-oriented configuration. The EPSS score is approximately 0.018% (0.000180), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

1. Precondition: Obtain local access to a system running a vulnerable Linux kernel (5.9–6.6.92, 6.7–6.12.30, 6.13–6.14.8, or 6.15-rc1 through rc5) with a Btrfs filesystem mounted using the rescue=idatacsums mount option.
2. Mount filesystem: Ensure the target Btrfs volume is mounted with the recovery option, e.g., mount -o rescue=idatacsums /dev/sdX /mnt/btrfs.
3. Trigger scrub: Invoke the Btrfs scrub operation on the mounted filesystem using the btrfs scrub start -r /mnt/btrfs command (read-only mode) or directly via the BTRFS_IOC_SCRUB ioctl.
4. Kernel crash: The scrub code path calls btrfs_lookup_csums_bitmap() without checking the NO_DATA_CSUMS flag, dereferencing a NULL csum tree pointer and triggering a kernel panic (BUG: kernel NULL pointer dereference), crashing the system (Feedly).

• Logs: Kernel logs (dmesg / /var/log/kern.log) showing BUG: kernel NULL pointer dereference, address: 0000000000000208 with a call trace including btrfs_lookup_csums_bitmap, scrub_find_fill_first_stripe, scrub_simple_mirror, scrub_stripe, scrub_chunk, scrub_enumerate_chunks, and btrfs_scrub_dev.
• Process: Presence of a btrfs process invoking scrub operations (btrfs scrub start) on a filesystem mounted with rescue=idatacsums.
• File System: Mount table entries (/proc/mounts or findmnt) showing a Btrfs volume mounted with the rescue=idatacsums option.

Apply the upstream kernel patches available for the affected stable branches: fix commits are available at 50d0de59f66c (6.6.x), 6e9770de0249 (6.12.x), d35bed14b0bc (6.14.x), and f95d186255b3 (6.15-rc) in the stable kernel tree (Kernel Patch 1). Distribution-specific updates have been released by SUSE (kernel updates in advisories SUSE-2025-02249-1, SUSE-2025-02538-1) and Ubuntu (USN-7769-1, USN-7771-1, USN-7769-2, USN-7769-3) (Feedly). As an immediate workaround, avoid using the rescue=idatacsums mount option unless absolutely necessary for filesystem recovery, and do not run scrub operations on filesystems mounted with this option until the kernel is patched.

The vulnerability received routine coverage from Linux security advisory aggregators including LinuxSecurity.com and pro-linux.de following SUSE and Ubuntu patch releases. No notable researcher commentary, vendor statements beyond patch advisories, or significant social media discussion has been identified for this CVE (Feedly).