CVE-2025-39738

Q: What is the severity of CVE-2025-39738?

CVE-2025-39738 has a CVSS score of 7.8 (HIGH). A Linux kernel Btrfs filesystem vulnerability allows transaction aborts when relocating partially dropped subvolumes, causing filesystem corruption and potential system crashes. This affects systems using Btrfs with older kernels that have zombie subvolumes from incomplete deletions. The issue manifests during balance operations or delayed reference processing.

7.8 HIGH

📋 TL;DR

A Linux kernel Btrfs filesystem vulnerability allows transaction aborts when relocating partially dropped subvolumes, causing filesystem corruption and potential system crashes. This affects systems using Btrfs with older kernels that have zombie subvolumes from incomplete deletions. The issue manifests during balance operations or delayed reference processing.

💻 Affected Systems

Products:

Linux kernel

Versions: Kernels before fixes in stable releases (specific commits: 125e94a4b76b7b75d194f85bedd628097d2121f0, 39a93e1c9dbf7e11632efeb20fcf0fc1dcf64d51, etc.)

Operating Systems: Linux distributions using Btrfs filesystem

Default Config Vulnerable: ✅ No

Notes: Only affects systems using Btrfs filesystem with subvolumes that were partially dropped due to older kernel bugs (pre-commit 8d488a8c7ba2). Requires specific conditions: zombie subvolumes from incomplete deletions.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Filesystem corruption leading to data loss, system crashes, and denial of service requiring filesystem repair or restoration from backups.

🟠

Likely Case

Transaction aborts during Btrfs balance operations causing temporary filesystem unavailability until remount, with potential minor data corruption.

🟢

If Mitigated

No impact if systems are patched or don't use Btrfs with problematic subvolume deletion patterns.

🌐 Internet-Facing: LOW - Requires local filesystem access and specific Btrfs operations.

🏢 Internal Only: MEDIUM - Can affect servers and workstations using Btrfs, particularly during maintenance operations like balance.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Not a traditional security exploit but a filesystem reliability issue. Requires specific Btrfs state (partially dropped subvolumes) and trigger conditions (balance/relocation operations).

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Linux kernel stable releases containing commits 125e94a4b76b7b75d194f85bedd628097d2121f0 and related fixes

Vendor Advisory: https://git.kernel.org/stable/c/125e94a4b76b7b75d194f85bedd628097d2121f0

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fixes. 2. Check distribution-specific security advisories. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Avoid Btrfs balance operations

linux

Prevent triggering the vulnerability by avoiding Btrfs balance commands on affected filesystems.

# Do not run: btrfs balance start /mount/point

Mount filesystem read-only

linux

Mount affected Btrfs filesystems as read-only to prevent write operations that could trigger the issue.

mount -o remount,ro /mount/point

🧯 If You Can't Patch

Avoid running btrfs balance or relocation operations on affected filesystems
Monitor system logs for BTRFS errors and transaction aborts, be prepared for filesystem repair

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if Btrfs is in use. Look for 'BTRFS: Transaction aborted' errors in dmesg or system logs during balance operations.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes the fix commits. Test with btrfs balance operations while monitoring for transaction aborts.

📡 Detection & Monitoring

Log Indicators:

BTRFS error: extent item not found for insert
BTRFS: Transaction aborted
failed to run delayed ref
WARNING: CPU: ... at ... btrfs_run_delayed_refs

Network Indicators:

None - local filesystem issue

SIEM Query:

source="kernel" AND "BTRFS" AND ("Transaction aborted" OR "extent item not found")

📊 Metadata

CVE ID: CVE-2025-39738

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score: 0.01% exploit probability (1.2th percentile)

Published: September 11, 2025

Last Updated: January 9, 2026

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Avoid Btrfs balance operations

Mount filesystem read-only

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export