VulnerabilityPublished 24 Dec 2025Updated 21 Oct 2026

CVE-2025-68359: Linux kernel · btrfs: fix double free of qgroup record after failure to add delayed ref head

Source GCVE Database

Authoritative record:CVE-2025-68359· Critical 9.8

Not known to be exploited · CVSS 9.8 Critical · fixed in 7617680769e3119dfb3b43a2b7c287ce2242211c : patch Linux kernel as a priority.

Data as of 26 Oct 2026, 17:16 UTC

CVSS 3.1 base score

9.8Critical

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.6% chance of exploitation in 30 days – higher than 49% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 7617680769e3119dfb3b43a2b7c287ce2242211c, 364685c4c2d9c9f4408d95451bcf42fdeebc3ebb, 725e46298876a2cc1f1c3fb22ba69d29102c3ddf +1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: High: There is total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Dec 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-wmvq-g95c-rpvj

What to do

Upgrade Linux kernel to 7617680769e3119dfb3b43a2b7c287ce2242211c, 364685c4c2d9c9f4408d95451bcf42fdeebc3ebb, 725e46298876a2cc1f1c3fb22ba69d29102c3ddf or 82d46660ebd94c269e3f25a77eb563621d8e67e3.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 6ef8fbce010421bf742b12b8f8f2b2d2ff154845, < 7617680769e3119dfb3b43a2b7c287ce2242211c	Fixed in 7617680769e3119dfb3b43a2b7c287ce2242211c
LinuxLinux	Affected ≥ 6ef8fbce010421bf742b12b8f8f2b2d2ff154845, < 364685c4c2d9c9f4408d95451bcf42fdeebc3ebb	Fixed in 364685c4c2d9c9f4408d95451bcf42fdeebc3ebb
LinuxLinux	Affected ≥ 6ef8fbce010421bf742b12b8f8f2b2d2ff154845, < 725e46298876a2cc1f1c3fb22ba69d29102c3ddf	Fixed in 725e46298876a2cc1f1c3fb22ba69d29102c3ddf
LinuxLinux	Affected ≥ 6ef8fbce010421bf742b12b8f8f2b2d2ff154845, < 82d46660ebd94c269e3f25a77eb563621d8e67e3	Fixed in 82d46660ebd94c269e3f25a77eb563621d8e67e3
LinuxLinux	Affected =6.12	Fixed in–

AI-suggested

A fix is available that changes the ownership model of the qgroup record object in the add_delayed_ref_head() function to prevent double freeing. Users should apply the official Linux kernel patches that address this issue. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly provided here; check the official Linux kernel advisories or vendor updates for the exact fixed versions and apply them promptly.

Description

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free of qgroup record after failure to add delayed ref head In the previous code it was possible to incur into a double kfree() scenario when calling add_delayed_ref_head(). This could happen if the record was reported to already exist in the btrfs_qgroup_trace_extent_nolock() call, but then there was an error later on add_delayed_ref_head(). In this case, since add_delayed_ref_head() returned an error, the caller went to free the record. Since add_delayed_ref_head() couldn't set this kfree'd pointer to NULL, then kfree() would have acted on a non-NULL 'record' object which was pointing to memory already freed by the callee. The problem comes from the fact that the responsibility to kfree the object is on both the caller and the callee at the same time. Hence, the fix for this is to shift the ownership of the 'qrecord' object out of the add_delayed_ref_head(). That is, we will never attempt to kfree() the given object inside of this function, and will expect the caller to act on the 'qrecord' object on its own. The only exception where the 'qrecord' object cannot be kfree'd is if it was inserted into the tracing logic, for which we already have the 'qrecord_inserted_ret' boolean to account for this. Hence, the caller has to kfree the object only if add_delayed_ref_head() reports not to have inserted it on the tracing logic. As a side-effect of the above, we must guarantee that 'qrecord_inserted_ret' is properly initialized at the start of the function, not at the end, and then set when an actual insert happens. This way we avoid 'qrecord_inserted_ret' having an invalid value on an early exit. The documentation from the add_delayed_ref_head() has also been updated to reflect on the exact ownership of the 'qrecord' object.

Impact

The vulnerability can lead to kernel memory corruption through a double free condition, which may cause system instability, crashes, or potential escalation of privilege if exploited. The CVSS vector indicates network attack vector with no privileges or user interaction required, and high impact on confidentiality, integrity, and availability, classifying it as critical.

Summary

CVE-2025-68359 addresses a double free vulnerability in the Linux kernel's Btrfs filesystem related to the handling of qgroup record objects in the add_delayed_ref_head() function. Previously, both the caller and callee could free the same memory, causing a double kfree() on the qgroup record if an error occurred after detecting an existing record. The patch shifts ownership responsibility solely to the caller, preventing the callee from freeing the object. Additionally, it ensures the 'qrecord_inserted_ret' flag is correctly initialized to avoid invalid states on early function exit. This resolves the risk of kernel memory corruption and potential denial of service.

References

Community reviews

Loading reviews…