CVE-2025-68358: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68358 is a race condition vulnerability in the Linux kernel's btrfs filesystem implementation, specifically in the btrfs_clear_space_info_full() function. The flaw involves unsynchronized (non-atomic) read-modify-write operations on a bitfield in the btrfs_space_info structure, where the full, chunk_alloc, and flush fields share the same underlying memory word but are protected by different locks. Affected kernel versions span from 4.8 through 6.18.1 across multiple stable branches. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Microsoft MSRC).

The root cause is classified as a race condition (CWE-362) arising from the compiler's non-atomic read-modify-write sequences when modifying bitfields. The btrfs_space_info structure packs full (bit 0), chunk_alloc (bit 1), and flush (bit 2) into a single 4-byte word at offset 176. When btrfs_clear_space_info_full() writes to the full bitfield without holding the lock that protects adjacent fields, a concurrent thread modifying chunk_alloc or flush under their respective locks can have their update overwritten — or vice versa — due to the non-atomic nature of the operation. The Linux kernel's own memory-barriers.txt documentation explicitly warns that bitfields must not be used for synchronization and that all fields in a shared bitfield word must be protected by a single lock (Feedly).

Successful exploitation can cause the flush flag in btrfs_space_info to become desynchronized from the actual state of the associated worker thread. If the flush flag remains set after the worker has exited, subsequent memory allocation operations will queue new tickets expecting a worker to process them, but no worker is available. This results in threads blocking indefinitely on allocation requests that can never be satisfied, effectively hanging the system or causing a denial of service on the affected btrfs filesystem. There is no confidentiality or integrity impact; the vulnerability is limited to availability (Feedly).

The fix converts the problematic bitfields (full, chunk_alloc, flush) from bitfield types to standalone bool fields, eliminating the shared memory word and preventing non-atomic corruption. Patched versions are available across all affected stable branches: upgrade to Linux kernel 5.15.201, 6.1.164, 6.6.124, 6.12.68, 6.17.13, or 6.18.2 (or later) depending on the deployed branch. Downstream distributions including Debian, Ubuntu, Oracle Linux, and Amazon Linux 2 have issued updated packages. No configuration-based workaround is available; kernel update is the only remediation (Feedly, Microsoft MSRC).