CVE-2025-21752
📋 TL;DR
A Linux kernel Btrfs filesystem vulnerability allows corruption of RAID stripe-tree metadata when using btrfs_set_item_key_safe() on RAID stripe-extents. This can cause kernel panics and filesystem corruption. Affects systems using Btrfs with RAID configurations.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Kernel panic leading to system crash and potential data corruption/loss in Btrfs RAID arrays
Likely Case
Filesystem corruption requiring fsck repair or data recovery during RAID operations
If Mitigated
Limited impact if Btrfs RAID is not used or system has recent backups
🎯 Exploit Status
Requires local access and ability to trigger specific Btrfs RAID operations; appears to be discovered through normal testing rather than malicious exploitation
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions with commits 1c25eff52ee5a02a2c4be659a44ae972d9989742 and dc14ba10781bd2629835696b7cc1febf914768e9
Vendor Advisory: https://git.kernel.org/stable/c/1c25eff52ee5a02a2c4be659a44ae972d9989742
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version from your distribution. 2. Reboot system to load new kernel. 3. Verify kernel version matches patched release.
🔧 Temporary Workarounds
Avoid Btrfs RAID operations
linuxTemporarily avoid operations that modify RAID stripe-extents until patched
Use alternative filesystem
linuxConsider using ext4 or XFS instead of Btrfs for RAID configurations
🧯 If You Can't Patch
- Implement regular Btrfs filesystem backups and snapshots
- Monitor system logs for BTRFS critical errors and kernel panics
🔍 How to Verify
Check if Vulnerable:
Check kernel version and if using Btrfs with RAID: 'uname -r' and 'btrfs filesystem show'Check Version:
uname -rVerify Fix Applied:
Verify kernel version includes the fix commits: 'uname -r' and check distribution patch notes📡 Detection & Monitoring
Log Indicators:
- BTRFS critical errors in kernel logs
- Kernel panic messages related to btrfs_set_item_key_safe
- Filesystem corruption errors
SIEM Query:
source="kernel" AND ("BTRFS critical" OR "btrfs_set_item_key_safe" OR "kernel panic" AND btrfs)