CVE-2025-68359
A critical bug in the Linux kernel’s Btrfs filesystem could cause a double free of a qgroup record, potentially crashing the system. The flaw occurs when adding a delayed reference head fails after the record was already reported to exist. The issue has been fixed in the kernel code.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users running the Btrfs filesystem, regardless of distribution or version, are potentially affected until they upgrade to a kernel that includes the fix.
Real-world impact
An attacker could trigger a crash or denial‑of‑service by exploiting the double free, causing the system to become unstable or unusable.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable from any network location, requires no privileges or user interaction, and can lead to complete compromise of confidentiality, integrity, and availability.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the CVE‑2025‑68359 fix.
- 02Reboot the system to load the updated kernel.
NVD-referenced vendor advisory
Timeline
- Dec 24, 2025 · Dec 24, 2025PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 6d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 6d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.