---
id: CVE-2025-37856
title: 'btrfs: harden block_group::bg_list against list_del() races'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  btrfs: harden block_group::bg_list against list_del() races

  As far as I can tell, these calls of list_del_init() on bg_list cannot
  run concurrently with btrfs_mark_bg_…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 01eca70ef8cf499d0cb6d1bbd691558e7792cf17 <
    ccb20413e7c82e4429c81f10d0e36cd9c0c643cd
  - >-
    Linux >= a9f189716cf15913c453299d72f69c51a9b0f86b <
    9039afe6240ae01d6caf2fa731590ac74fb8a69b
  - >-
    Linux >= a9f189716cf15913c453299d72f69c51a9b0f86b <
    bf089c4d1141b27332c092b1dcca5022c415a3b6
  - >-
    Linux >= a9f189716cf15913c453299d72f69c51a9b0f86b <
    909e60fb469d4101c6b08cf6e622efb062bb24a1
  - >-
    Linux >= a9f189716cf15913c453299d72f69c51a9b0f86b <
    185fd73e5ac06027c4be9a129e59193f6a3ef202
  - >-
    Linux >= a9f189716cf15913c453299d72f69c51a9b0f86b <
    7511e29cf1355b2c47d0effb39e463119913e2f6
  - Linux edf3b5aadb2515c808200b904baa5b70a727f0ac
  - Linux 5d19abcffd8404078dfa7d7118cec357b5e7bc58
  - Linux >= 6.1.47 < 6.1.191
  - Linux >= 5.15.128 < 5.16
  - Linux >= 6.4.12 < 6.5
  - Linux 6.5
published: '2025-05-09'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:21:24.224Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-37856'
references:
  - url: 'https://git.kernel.org/stable/c/ccb20413e7c82e4429c81f10d0e36cd9c0c643cd'
  - url: 'https://git.kernel.org/stable/c/9039afe6240ae01d6caf2fa731590ac74fb8a69b'
  - url: 'https://git.kernel.org/stable/c/bf089c4d1141b27332c092b1dcca5022c415a3b6'
  - url: 'https://git.kernel.org/stable/c/909e60fb469d4101c6b08cf6e622efb062bb24a1'
  - url: 'https://git.kernel.org/stable/c/185fd73e5ac06027c4be9a129e59193f6a3ef202'
  - url: 'https://git.kernel.org/stable/c/7511e29cf1355b2c47d0effb39e463119913e2f6'
tags:
  - cve.org
epss: 0.0031
epssPercentile: 0.2383
ingestedAt: '2026-10-21T12:48:53.711Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

btrfs: harden block_group::bg_list against list_del() races

As far as I can tell, these calls of list_del_init() on bg_list cannot
run concurrently with btrfs_mark_bg_unused() or btrfs_mark_bg_to_reclaim(),
as they are in transaction error paths and situations where the block
group is readonly.

However, if there is any chance at all of racing with mark_bg_unused(),
or a different future user of bg_list, better to be safe than sorry.

Otherwise we risk the following interleaving (bg_list refcount in parens)

T1 (some random op)                       T2 (btrfs_mark_bg_unused)
                                        !list_empty(&bg->bg_list); (1)
list_del_init(&bg->bg_list); (1)
                                        list_move_tail (1)
btrfs_put_block_group (0)
                                        btrfs_delete_unused_bgs
                                             bg = list_first_entry
                                             list_del_init(&bg->bg_list);
                                             btrfs_put_block_group(bg); (-1)

Ultimately, this results in a broken ref count that hits zero one deref
early and the real final deref underflows the refcount, resulting in a WARNING.

## Affected

- `Linux >= 01eca70ef8cf499d0cb6d1bbd691558e7792cf17 < ccb20413e7c82e4429c81f10d0e36cd9c0c643cd`
- `Linux >= a9f189716cf15913c453299d72f69c51a9b0f86b < 9039afe6240ae01d6caf2fa731590ac74fb8a69b`
- `Linux >= a9f189716cf15913c453299d72f69c51a9b0f86b < bf089c4d1141b27332c092b1dcca5022c415a3b6`
- `Linux >= a9f189716cf15913c453299d72f69c51a9b0f86b < 909e60fb469d4101c6b08cf6e622efb062bb24a1`
- `Linux >= a9f189716cf15913c453299d72f69c51a9b0f86b < 185fd73e5ac06027c4be9a129e59193f6a3ef202`
- `Linux >= a9f189716cf15913c453299d72f69c51a9b0f86b < 7511e29cf1355b2c47d0effb39e463119913e2f6`
- `Linux edf3b5aadb2515c808200b904baa5b70a727f0ac`
- `Linux 5d19abcffd8404078dfa7d7118cec357b5e7bc58`
- `Linux >= 6.1.47 < 6.1.191`
- `Linux >= 5.15.128 < 5.16`
- `Linux >= 6.4.12 < 6.5`
- `Linux 6.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.