CVE-2025-38260: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability has been identified in the Linux kernel's BTRFS filesystem handling, tracked as CVE-2025-38260. The issue was discovered on July 9, 2025, and affects the way the kernel handles checksum tree errors with the rescue=ibadroots mount option (NVD).

The vulnerability occurs when mounting a BTRFS filesystem with a corrupted checksum tree root using the 'ro,rescue=ibadroots' mount option. The issue stems from improper error handling in the load_global_roots_objectid() function, where a failure in read_tree_root_path() doesn't properly set the BTRFS_FS_STATE_NO_DATA_CSUMS flag, leading to unexpected checksum lookups. This can result in a null pointer dereference and kernel crash (NVD).

When exploited, this vulnerability can cause a kernel crash through a null pointer dereference, potentially leading to denial of service conditions. The issue is particularly concerning for systems using BTRFS filesystems with corrupted checksum trees (NVD).

A proof-of-concept exploit exists through a syzbot-based reproducer that can trigger the kernel crash. The vulnerability requires local access to a system with a BTRFS filesystem and the ability to mount filesystems with specific options (NVD).

The fix involves modifying the error handling in read_tree_root_path() to always populate the error number in the return value, ensuring proper handling of corrupted checksum trees. This ensures the BTRFS_FS_STATE_NO_DATA_CSUMS flag is set correctly when needed (NVD).