CVE-2025-38365
A race condition exists in the Linux kernel's Btrfs filesystem during file renaming operations. If a system crash or power failure occurs at a specific moment during this process, the filesystem may incorrectly delete files upon the next mount.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Users running the Linux kernel, specifically mentioned versions include 6.16 and Debian 11.0, who are using the Btrfs filesystem.
Real-world impact
An attacker cannot directly exploit this, but a sudden power loss or system crash could lead to permanent data loss, as the filesystem may delete files that were being renamed.
Why this severity
The critical score reflects that this vulnerability can lead to significant data loss (integrity and availability) and is triggered by specific system states, though it requires a crash or power failure to manifest.
What to do about it
- 01Upgrade the Linux kernel to a version containing the fix for the btrfs rename and directory logging race condition.
NVD-referenced vendor advisory
Timeline
- Jul 25, 2025 · Jul 25, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 7d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 6d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
How it’s attacked
References & advisories
- git.kernel.org/stable/c/2088895d5903082bb9…patch
- git.kernel.org/stable/c/3ca864de852bc91007…patch
- git.kernel.org/stable/c/51bd363c7010d033d3…patch
- git.kernel.org/stable/c/8c6874646c21bd820c…patch
- git.kernel.org/stable/c/aeeae8feeaae4445a8…patch
- lists.debian.org/debian-lts-announce/2025/10…third party advisory