CVE-2025-21753

A use-after-free (UAF) vulnerability was found in Btrfs. A transaction handling allowed a race condition where an aborted transaction could be accessed after being freed, leading to potential kernel crashes or filesystem corruption.

Red Hat Enterprise Linux is not vulnerable to this CVE, as it does not affect the versions or configurations of the Linux kernel used in its distributions.

This vulnerability marked as a Moderate severity instead of Important because, while it leads to a use-after-free (UAF) bug, its exploitability is limited. The issue occurs in the Btrfs transaction handling code, which primarily affects filesystem operations rather than exposing a direct attack surface to unprivileged users. To trigger this bug, an attacker would likely need local access and the ability to perform concurrent file operations in a way that causes a race condition. Additionally, while UAF bugs can sometimes lead to arbitrary code execution, this particular case is more likely to result in kernel crashes or filesystem corruption rather than immediate privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.