Race condition in Linux kernel Btrfs block_group::bg_list handling
CVE-2025-37856 is a race condition in the Linux kernel Btrfs filesystem code involving block_group::bg_list manipulation. The issue arises from unsynchronized list_del_init() operations on bg_list that can race with btrfs_mark_bg_unused() and related bg_list users. The described interleaving allows one thread to remove a block group from the list while another thread still observes the list entry as present and moves or deletes it again. This corrupts the associated block-group reference counting lifecycle: the refcount can reach zero one dereference too early, and the true final dereference then underflows the refcount, producing a kernel WARNING. The fix hardens bg_list handling against these list_del() races in the Btrfs block group management path.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.