CVE-2025-71159

A memory ordering race condition was found in the Linux kernel's Btrfs filesystem. In btrfs_get_or_create_delayed_node(), the refcount is set inside the critical section without a memory barrier, allowing stores to node->refs and btrfs_inode->delayed_node to become visible out of order. Another thread can read the delayed_node pointer before its refcount is initialized, causing a refcounting bug that triggers a use-after-free warning.

This race condition was introduced by a commit that moved refcount_set inside the lock's critical section, inadvertently removing the implicit memory barrier from lock acquisition. The issue manifests as use-after-free warnings on multi-core systems under concurrent Btrfs inode operations. While the warning indicates a potential UAF, practical exploitation is limited by the timing requirements.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.