CVE-2025-40100: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-40100 is a vulnerability discovered in the Linux kernel's BTRFS filesystem component, specifically related to the free space tree functionality. The vulnerability was disclosed on October 30, 2025, affecting systems using the BTRFS filesystem (NVD, Red Hat Portal).

The vulnerability occurs in the populatefreespacetree() function when building a free space tree without using the block group tree feature. The system incorrectly assumes the presence of block group items (either extent items or items with BTRFSBLOCKGROUPITEMKEY type) during extent tree searches with btrfssearchslotfor_read(). This assumption fails when new block groups are created in the current transaction but haven't yet had their items added to the extent tree. The issue manifests as an assertion failure in fs/btrfs/free-space-tree.c:1115 (NVD).

The vulnerability has been assigned a CVSS v3.1 score of 5.5, indicating a moderate severity level. The impact is primarily related to system availability, as it can cause kernel crashes when the assertion failure occurs during filesystem operations (Red Hat Portal).

The vulnerability has been fixed in Linux kernel version 6.17.6-1. Various Linux distributions have released or are in the process of releasing patches to address this vulnerability. Red Hat has marked this issue as 'Fix deferred' for some of their products (Debian Tracker).