CVE-2025-37904 is a vulnerability identified in the Linux kernel's Btrfs filesystem implementation. The issue arises from an inode leak in the function btrfs_iget(), which is responsible for inode retrieval and management within the Btrfs filesystem. Specifically, when the function btrfs_alloc_path() fails during the inode retrieval process, btrfs_iget() returns prematurely without releasing an inode that was already allocated by btrfs_iget_locked(). This improper handling leads to a 'busy inode' condition during filesystem unmount operations, which can trigger a kernel BUG and cause a kernel panic or system crash. The bug is reproducible by syzbot, an automated kernel fuzzing tool, indicating that it can be triggered under certain conditions. The root cause is a missing call to iget_failed() in the error path of btrfs_iget(), which should properly release the allocated inode resources upon failure. The fix involves ensuring iget_failed() is called if btrfs_alloc_path() fails, preventing the inode leak and subsequent kernel panic. This vulnerability affects Linux kernel versions around 6.15.0-rc2 and likely other versions using the affected Btrfs code path. It is a memory/resource management bug within the filesystem code, leading to system instability rather than direct remote code execution or privilege escalation. No known exploits are reported in the wild at this time.

For European organizations relying on Linux systems with Btrfs filesystems, this vulnerability poses a risk of system instability and potential denial of service (DoS) due to kernel panics triggered by inode leaks during filesystem unmount operations. This can affect servers, workstations, or embedded devices using Btrfs, particularly in environments where filesystems are frequently mounted and unmounted or where automated testing/fuzzing tools might trigger the bug. The impact is primarily on availability, as affected systems may crash or become unresponsive, requiring reboots and potentially causing service interruptions. While this does not directly lead to data breaches or privilege escalation, repeated crashes could disrupt critical services, data processing, or operational continuity. Organizations with infrastructure running Linux kernels that include the vulnerable Btrfs code should be aware of the risk, especially those using Btrfs for storage management, snapshots, or RAID configurations. The vulnerability also highlights the importance of kernel updates and filesystem stability in maintaining operational resilience.

European organizations should prioritize updating their Linux kernels to versions where this vulnerability is patched. Since the fix involves calling iget_failed() properly, kernel updates from official Linux distributions or backported patches from vendors should be applied promptly. System administrators should audit their environments to identify systems using Btrfs filesystems and verify kernel versions. In environments where immediate patching is not feasible, minimizing frequent mount/unmount operations of Btrfs filesystems can reduce exposure. Additionally, monitoring kernel logs for signs of 'busy inode' messages or kernel BUGs related to Btrfs can help detect attempts to trigger this vulnerability. For critical systems, consider implementing kernel crash dump analysis and automated recovery procedures to reduce downtime. Engaging with Linux distribution vendors for timely security updates and testing patches in staging environments before production deployment is recommended. Finally, organizations should maintain robust backup and recovery strategies to mitigate potential data availability issues caused by unexpected system crashes.