linux-cve-announce - CVE-2025-40101: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025103017-CVE-2025-40101-d0c0@gregkh>
Date: Thu, 30 Oct 2025 10:48:28 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-40101: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST

At the end of btrfs_load_block_group_zone_info() the first thing we do
is to ensure that if the mapping type is not a SINGLE one and there is
no RAID stripe tree, then we return early with an error.

Doing that, though, prevents the code from running the last calls from
this function which are about freeing memory allocated during its
run. Hence, in this case, instead of returning early, we set the ret
value and fall through the rest of the cleanup code.

The Linux kernel CVE team has assigned CVE-2025-40101 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.8 with commit 5906333cc4af7b3fdb8cfff1cb3e8e579bd13174 and fixed in 6.12.55 with commit 187333e6d484c6630286bfdd07c79d6815a63887
	Issue introduced in 6.8 with commit 5906333cc4af7b3fdb8cfff1cb3e8e579bd13174 and fixed in 6.17.5 with commit 602701d00439e113331ee9c1283e95afdcb8849d
	Issue introduced in 6.8 with commit 5906333cc4af7b3fdb8cfff1cb3e8e579bd13174 and fixed in 6.18-rc2 with commit fec9b9d3ced39f16be8d7afdf81f4dd2653da319
	Issue introduced in 6.7.11 with commit 6ffeca99bf6e84800133d21afd41c79d2f002db7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-40101
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/btrfs/zoned.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/187333e6d484c6630286bfdd07c79d6815a63887
	https://git.kernel.org/stable/c/602701d00439e113331ee9c1283e95afdcb8849d
	https://git.kernel.org/stable/c/fec9b9d3ced39f16be8d7afdf81f4dd2653da319