CVE-2025-68359

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix double free of qgroup record after failure to add delayed ref head

In the previous code it was possible to incur into a double kfree() scenario when calling add_delayed_ref_head(). This could happen if the record was reported to already exist in the btrfs_qgroup_trace_extent_nolock() call, but then there was an error later on add_delayed_ref_head(). In this case, since add_delayed_ref_head() returned an error, the caller went to free the record. Since add_delayed_ref_head() couldn't set this kfree'd pointer to NULL, then kfree() would have acted on a non-NULL 'record' object which was pointing to memory already freed by the callee.

The problem comes from the fact that the responsibility to kfree the object is on both the caller and the callee at the same time. Hence, the fix for this is to shift the ownership of the 'qrecord' object out of the add_delayed_ref_head(). That is, we will never attempt to kfree() the given object inside of this function, and will expect the caller to act on the 'qrecord' object on its own. The only exception where the 'qrecord' object cannot be kfree'd is if it was inserted into the tracing logic, for which we already have the 'qrecord_inserted_ret' boolean to account for this. Hence, the caller has to kfree the object only if add_delayed_ref_head() reports not to have inserted it on the tracing logic.

As a side-effect of the above, we must guarantee that 'qrecord_inserted_ret' is properly initialized at the start of the function, not at the end, and then set when an actual insert happens. This way we avoid 'qrecord_inserted_ret' having an invalid value on an early exit.

The documentation from the add_delayed_ref_head() has also been updated to reflect on the exact ownership of the 'qrecord' object.

A low-severity flaw was found in the Linux kernel's btrfs file system implementation. When quota groups (qgroups) are enabled on a btrfs file system, ownership of a heap-allocated qgroup trace record was ambiguously shared between add_delayed_ref_head() and its caller. If btrfs_qgroup_trace_extent_nolock() reported that a record already existed and add_delayed_ref_head() subsequently failed, the callee could free the record while the caller still held a non-NULL pointer, causing a double kfree() on the error path. A local user with access to a mounted btrfs file system with qgroups enabled could trigger this condition through filesystem operations that generate delayed references, most likely resulting in memory corruption or a kernel crash (denial of service). The vulnerable code is not present in the Red Hat Enterprise Linux 7, 8, 9, and 10 kernel and kernel-rt packages nor in the Red Hat In-Vehicle OS 1 kernel, so those products are not affected; the only Red Hat entry marked as affected is the Red Hat Enterprise Linux 6 Extended Lifecycle Support kernel, which is out of support scope. The upstream CVEORG severity of Critical (CVSS 9.8, network attack vector) does not reflect the actual risk: exploitation requires local access to a system with a mounted btrfs file system with quota groups enabled and depends on a narrow error path, with availability being the primary impact. For these reasons Red Hat rates this flaw LOW with a CVSS of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.