External risk intelligence

Linux Kernel Btrfs Double Free Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-68359

This vulnerability exists within the Linux kernel's Btrfs file system management code. File system operations are low-level, internal kernel functions not exposed directly to the network, and they cannot be reached or triggered by remote users through standard public-facing network services.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a memory management issue within the Linux kernel's Btrfs file system. The problem, if exploited, could lead to a double-free condition, meaning memory is freed twice, potentially causing system instability or data corruption. While the vulnerability exists in a core operating system component, its direct impact on externally facing services is considered unlikely.

A kernel flaw could cause memory to be freed twice.
This impacts core operating system stability.
Confirm relevance and exposure; direct external impact is unlikely.

Attack Path

How an attacker could exploit the issue

This vulnerability in the Linux kernel's Btrfs file system involves a potential double-free error when handling qgroup records. An attacker could potentially trigger this by manipulating file system operations in a way that leads to an error during the addition of a delayed reference head, causing memory to be freed twice.

Requires local access to the system.
Triggered by specific file system operations.
Potential for system instability or crash.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the integrity of the Btrfs file system when specific operations fail, potentially leading to instability or data corruption. It occurs when a record is reported as existing but an error prevents its proper addition, causing the system to attempt freeing already freed memory.

File system metadata integrity.
Repeated operations with delayed references.
System instability or data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides in the Linux kernel's Btrfs file system, specifically within the handling of qgroup records. Ownership of the affected code typically falls to the operating system or infrastructure team responsible for managing the Linux kernel and its components. The first practical step is to confirm the presence of the vulnerable kernel version on critical systems and assess the potential impact of the double-free condition on data integrity or system stability.

Infrastructure or OS team owns the issue.
Verify Linux kernel version and Btrfs usage.
Plan updates during scheduled maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Btrfs component in the Linux kernel?

Btrfs, or the B-tree file system, is a modern copy-on-write file system for Linux. It manages how data is stored, organized, and retrieved on storage devices. It includes advanced features like snapshots, data integrity checksums, and quota management, which uses qgroup records to track storage usage. This vulnerability specifically involves the memory management logic used to track these storage quotas within the kernel.

What is a double-free vulnerability in CVE-2025-68359?

A double-free is a memory corruption flaw where a program tries to release the same area of system memory twice. In this CVE, the Linux kernel mistakenly attempts to free a qgroup record that has already been deallocated. This happens due to a confusion in code ownership; both the caller and the callee were trying to free the same object. This can cause the kernel to crash, leading to system instability or unpredictable data behavior.

How can an attacker trigger this kernel memory bug?

Triggering this requires the ability to perform specific, low-level file system operations that fail during the addition of a delayed reference head. It is not triggered by standard network requests or basic file access. Operations that do not involve complex quota management or specific error conditions during delayed reference tracking do not cause this flaw to manifest.

Is my system at risk according to Halo Surface Signal?

According to Halo Surface Signal, it is very unlikely that your system is exposed to this threat. This vulnerability is buried deep within low-level kernel code responsible for internal file system management. Because these functions are not reachable via standard, public-facing network services, they cannot be triggered by remote attackers over the internet.

What steps should I take if I run the Linux kernel?

First, verify if your Linux distribution uses Btrfs as its file system. If it does, check your current kernel version to see if it is affected. Since this is an internal kernel issue, responsibility for remediation typically lies with your infrastructure or systems administration team. Plan to apply official kernel updates during your next scheduled maintenance window to ensure stability and data integrity.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.