CVE-2025-37931

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

btrfs: adjust subpage bit start based on sectorsize

When running machines with 64k page size and a 16k nodesize we started

seeing tree log corruption in production. This turned out to be because

we were not writing out dirty blocks sometimes, so this in fact affects

all metadata writes.

When writing out a subpage EB we scan the subpage bitmap for a dirty

range. If the range isn't dirty we do

bit_start++;

to move onto the next bit. The problem is the bitmap is based on the

number of sectors that an EB has. So in this case, we have a 64k

pagesize, 16k nodesize, but a 4k sectorsize. This means our bitmap is 4

bits for every node. With a 64k page size we end up with 4 nodes per

page.

To make this easier this is how everything looks

[0 16k 32k 48k ] logical address

[0 4 8 12 ] radix tree offset

[ 64k page ] folio

[ 16k eb ][ 16k e

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References