CVE-2025-39738: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-39738 is a denial-of-service vulnerability in the Linux kernel's Btrfs filesystem implementation, caused by improper handling of partially dropped subvolumes during balance/relocation operations. When the relocation code processes a subvolume that is in a half-dropped state (orphaned from an interrupted deletion), it encounters missing backref items in the extent tree, triggering a transaction abort with error code -117. The vulnerability was published on September 11, 2025, and affects Linux kernel versions from 5.11 through multiple stable branches up to 6.16.x. It carries a CVSS v3.1 base score of 7.8 (High) (Feedly, Microsoft MSRC).

The root cause is improper input validation / missing state check (related to CWE-20) in the Btrfs relocation path: the kernel does not reject partially dropped subvolumes before attempting to relocate their extents. When a subvolume deletion is interrupted mid-way, orphaned tree block backrefs remain in the extent tree referencing a root that no longer fully exists. A subsequent balance operation attempts to process these extents, fails to find the expected backref item (e.g., at bytenr 594526208), and calls btrfs_run_delayed_refs() which aborts the transaction at fs/btrfs/extent-tree.c:2168. The attack vector is local, requiring low privileges and the ability to trigger a Btrfs balance operation on a filesystem containing such orphaned subvolumes (Feedly, git.kernel.org).

Successful exploitation causes a kernel-level Btrfs transaction abort, resulting in denial of service, potential data loss, and system instability on affected hosts. The availability impact is high, as ongoing filesystem operations are forcibly terminated; integrity and confidentiality impacts are also rated high in the CVSS scoring, reflecting the risk of filesystem corruption and possible exposure of inconsistent data states. Systems using Btrfs with subvolume management — particularly those that have experienced interrupted subvolume deletions — are most at risk, and the issue does not facilitate lateral movement but can render storage subsystems unusable (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges and a specific filesystem state (partially dropped subvolumes), which significantly limits the practical attack surface.

• Logs: Kernel logs (dmesg / /var/log/kern.log) containing BTRFS error (device ...): extent item not found for insert or BTRFS: Transaction aborted (error -117).
• Logs: Kernel warnings at fs/btrfs/extent-tree.c:2168 referencing btrfs_run_delayed_refs with a non-zero error code.
• Logs: Messages such as failed to run delayed ref for logical <bytenr> num_bytes <size> type 182 action 1 ref_mod 1: -117.
• File System: Presence of orphaned Btrfs subvolumes detectable via btrfs subvolume list showing subvolumes in a partially deleted state, or btrfs check reporting inconsistencies in the extent tree.
• Process: Unexpected termination or hang of processes performing Btrfs balance operations (btrfs balance start or kernel balance threads).

Update the Linux kernel to a patched stable version: 5.15.190+, 6.1.149+, 6.6.103+, 6.12.43+, 6.15.11+, or 6.16.2+. Microsoft has also released a patch for the Azure Linux 3 kernel (azl3_kernel_6.6.96.2-2). As an immediate workaround, avoid running Btrfs balance operations on filesystems that may contain orphaned or partially dropped subvolumes; run btrfs check periodically to identify and repair corrupted filesystem metadata before attempting balance. Patch commits are available at git.kernel.org for manual integration if distribution packages are not yet available (Feedly, Microsoft MSRC, git.kernel.org).