CVE-2025-40100

A flaw was found in the Linux kernel's Btrfs filesystem. In populate_free_space_tree(), an incorrect assertion assumes that block group items always exist in the extent tree when rebuilding the free space tree. However, newly created block groups in the current transaction may be empty and not yet have their items added to the extent tree. When this condition occurs, the assertion fails, triggering a kernel BUG and system crash. This can be triggered during filesystem remount operations.

This vulnerability affects systems using Btrfs filesystems with free space tree features. The issue can be triggered during mount or remount operations when the filesystem has pending block groups. Exploitation requires local access and ability to mount/remount Btrfs filesystems.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.