{"id":"CVE-2025-21658","title":"btrfs: avoid NULL pointer dereference if no valid extent tree","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: avoid NULL pointer dereference if no valid extent tree\n\n[BUG]\nSyzbot reported a crash with the following call trace:\n\n  BTRFS info (device loop0): scrub: started…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"adp","vendor":"Linux","product":"Linux","affected":["Linux >= 42437a6386ffeaaf200731e73d723ea491f3fe7d < 1fb37b7840fdcbf69d062a79d14afbf566b11873","Linux >= 42437a6386ffeaaf200731e73d723ea491f3fe7d < 24b85a8b0310e0144da9ab30be42e87e6476638a","Linux >= 42437a6386ffeaaf200731e73d723ea491f3fe7d < aee5f69f3e6cd82bfefaca1b70b40b6cd8f3f784","Linux >= 42437a6386ffeaaf200731e73d723ea491f3fe7d < 6aecd91a5c5b68939cf4169e32bc49f3cd2dd329","Linux 5.11"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2025-10-01T19:52:37.080379Z"},"published":"2025-01-21","updated":"2026-10-30","sourceUpdated":"2026-10-30T12:20:41.665Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-21658","references":[{"url":"https://git.kernel.org/stable/c/1fb37b7840fdcbf69d062a79d14afbf566b11873"},{"url":"https://git.kernel.org/stable/c/24b85a8b0310e0144da9ab30be42e87e6476638a"},{"url":"https://git.kernel.org/stable/c/aee5f69f3e6cd82bfefaca1b70b40b6cd8f3f784"},{"url":"https://git.kernel.org/stable/c/6aecd91a5c5b68939cf4169e32bc49f3cd2dd329"}],"tags":["cve.org"],"epss":0.00203,"epssPercentile":0.10319,"ingestedAt":"2026-11-03T15:48:07.696Z","slug":"CVE-2025-21658","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: avoid NULL pointer dereference if no valid extent tree\n\n[BUG]\nSyzbot reported a crash with the following call trace:\n\n  BTRFS info (device loop0): scrub: started on devid 1\n  BUG: kernel NULL pointer dereference, address: 0000000000000208\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  PGD 106e70067 P4D 106e70067 PUD 107143067 PMD 0\n  Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI\n  CPU: 1 UID: 0 PID: 689 Comm: repro Kdump: loaded Tainted: G           O       6.13.0-rc4-custom+ #206\n  Tainted: [O]=OOT_MODULE\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS unknown 02/02/2022\n  RIP: 0010:find_first_extent_item+0x26/0x1f0 [btrfs]\n  Call Trace:\n   <TASK>\n   scrub_find_fill_first_stripe+0x13d/0x3b0 [btrfs]\n   scrub_simple_mirror+0x175/0x260 [btrfs]\n   scrub_stripe+0x5d4/0x6c0 [btrfs]\n   scrub_chunk+0xbb/0x170 [btrfs]\n   scrub_enumerate_chunks+0x2f4/0x5f0 [btrfs]\n   btrfs_scrub_dev+0x240/0x600 [btrfs]\n   btrfs_ioctl+0x1dc8/0x2fa0 [btrfs]\n   ? do_sys_openat2+0xa5/0xf0\n   __x64_sys_ioctl+0x97/0xc0\n   do_syscall_64+0x4f/0x120\n   entry_SYSCALL_64_after_hwframe+0x76/0x7e\n   </TASK>\n\n[CAUSE]\nThe reproducer is using a corrupted image where extent tree root is\ncorrupted, thus forcing to use \"rescue=all,ro\" mount option to mount the\nimage.\n\nThen it triggered a scrub, but since scrub relies on extent tree to find\nwhere the data/metadata extents are, scrub_find_fill_first_stripe()\nrelies on an non-empty extent root.\n\nBut unfortunately scrub_find_fill_first_stripe() doesn't really expect\nan NULL pointer for extent root, it use extent_root to grab fs_info and\ntriggered a NULL pointer dereference.\n\n[FIX]\nAdd an extra check for a valid extent root at the beginning of\nscrub_find_fill_first_stripe().\n\nThe new error path is introduced by 42437a6386ff (\"btrfs: introduce\nmount option rescue=ignorebadroots\"), but that's pretty old, and later\ncommit b979547513ff (\"btrfs: scrub: introduce helper to find and fill\nsector info for a scrub_stripe\") changed how we do scrub.\n\nSo for kernels older than 6.6, the fix will need manual backport.\n\n## Affected\n\n- `Linux >= 42437a6386ffeaaf200731e73d723ea491f3fe7d < 1fb37b7840fdcbf69d062a79d14afbf566b11873`\n- `Linux >= 42437a6386ffeaaf200731e73d723ea491f3fe7d < 24b85a8b0310e0144da9ab30be42e87e6476638a`\n- `Linux >= 42437a6386ffeaaf200731e73d723ea491f3fe7d < aee5f69f3e6cd82bfefaca1b70b40b6cd8f3f784`\n- `Linux >= 42437a6386ffeaaf200731e73d723ea491f3fe7d < 6aecd91a5c5b68939cf4169e32bc49f3cd2dd329`\n- `Linux 5.11`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}