« Volver al listado

CVE-2023-53865

Estado: AplazadaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix warning when putting transaction with qgroups enabled after abort

If we have a transaction abort with qgroups enabled we get a warning triggered when doing the final put on the transaction, like this:

This corresponds to this line of code:

The warning happens because btrfs_qgroup_destroy_extent_records(), called in the transaction abort path, we free all entries from the rbtree "dirty_extent_root" with rbtree_postorder_for_each_entry_safe(), but we don't actually empty the rbtree - it's still pointing to nodes that were freed.

Leer descripción completaMostrar menos

So set the rbtree's root node to NULL to avoid this warning (assign RB_ROOT).

Detalles técnicos trazas, registros y código del informe original
  [552.6789] ------------[ cut here ]------------
  [552.6815] WARNING: CPU: 4 PID: 81745 at fs/btrfs/transaction.c:144 btrfs_put_transaction+0x123/0x130 [btrfs]
  [552.6817] Modules linked in: btrfs blake2b_generic xor (...)
  [552.6819] CPU: 4 PID: 81745 Comm: btrfs-transacti Tainted: G        W          6.4.0-rc6-btrfs-next-134+ #1
  [552.6819] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014
  [552.6819] RIP: 0010:btrfs_put_transaction+0x123/0x130 [btrfs]
  [552.6821] Code: bd a0 01 00 (...)
  [552.6821] RSP: 0018:ffffa168c0527e28 EFLAGS: 00010286
  [552.6821] RAX: ffff936042caed00 RBX: ffff93604a3eb448 RCX: 0000000000000000
  [552.6821] RDX: ffff93606421b028 RSI: ffffffff92ff0878 RDI: ffff93606421b010
  [552.6821] RBP: ffff93606421b000 R08: 0000000000000000 R09: ffffa168c0d07c20
  [552.6821] R10: 0000000000000000 R11: ffff93608dc52950 R12: ffffa168c0527e70
  [552.6821] R13: ffff93606421b000 R14: ffff93604a3eb420 R15: ffff93606421b028
  [552.6821] FS:  0000000000000000(0000) GS:ffff93675fb00000(0000) knlGS:0000000000000000
  [552.6821] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  [552.6821] CR2: 0000558ad262b000 CR3: 000000014feda005 CR4: 0000000000370ee0
  [552.6822] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  [552.6822] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  [552.6822] Call Trace:
  [552.6822]  <TASK>
  [552.6822]  ? __warn+0x80/0x130
  [552.6822]  ? btrfs_put_transaction+0x123/0x130 [btrfs]
  [552.6824]  ? report_bug+0x1f4/0x200
  [552.6824]  ? handle_bug+0x42/0x70
  [552.6824]  ? exc_invalid_op+0x14/0x70
  [552.6824]  ? asm_exc_invalid_op+0x16/0x20
  [552.6824]  ? btrfs_put_transaction+0x123/0x130 [btrfs]
  [552.6826]  btrfs_cleanup_transaction+0xe7/0x5e0 [btrfs]
  [552.6828]  ? _raw_spin_unlock_irqrestore+0x23/0x40
  [552.6828]  ? try_to_wake_up+0x94/0x5e0
  [552.6828]  ? __pfx_process_timeout+0x10/0x10
  [552.6828]  transaction_kthread+0x103/0x1d0 [btrfs]
  [552.6830]  ? __pfx_transaction_kthread+0x10/0x10 [btrfs]
  [552.6832]  kthread+0xee/0x120
  [552.6832]  ? __pfx_kthread+0x10/0x10
  [552.6832]  ret_from_fork+0x29/0x50
  [552.6832]  </TASK>
  [552.6832] ---[ end trace 0000000000000000 ]---

  void btrfs_put_transaction(struct btrfs_transaction *transaction)
  {
      (...)
          WARN_ON(!RB_EMPTY_ROOT(
                          &transaction->delayed_refs.dirty_extent_root));
      (...)
  }

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-53865",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "40ea30638d20c92b44107247415842b72c460459",
              "lessThan": "ae91ab710d8e309f6c9eba07ce0d9d0b5d9040f0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "81f7eb00ff5bb8326e82503a32809421d14abb8a",
              "lessThan": "d2c667cc18314c9bad3ec86ae071c0342132aa09",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "81f7eb00ff5bb8326e82503a32809421d14abb8a",
              "lessThan": "c9060caab4135dd660c4676d1ea33a6e0d3fc09d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "81f7eb00ff5bb8326e82503a32809421d14abb8a",
              "lessThan": "89e994688e965813ec0a09fb30b87fb8cee06474",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "81f7eb00ff5bb8326e82503a32809421d14abb8a",
              "lessThan": "62dd82bc7a90b5052c062a0ad5be6d8a479a3cfb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "81f7eb00ff5bb8326e82503a32809421d14abb8a",
              "lessThan": "aa84ce8a78a1a5c10cdf9c7a5fb0c999fbc2c8d6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4e2e49d4211db43e0ec932579dab6a969e7e8df1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5.4.23",
              "lessThan": "5.4.251",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.5.7",
              "lessThan": "5.6",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "fs/btrfs/qgroup.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.6",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.4.251",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "status": "unaffected",
              "version": "5.10.188",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.123",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.42",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.4.7",
              "versionType": "semver",
              "lessThanOrEqual": "6.4.*"
            },
            {
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/btrfs/qgroup.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-12-09T16:17:27.413",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/62dd82bc7a90b5052c062a0ad5be6d8a479a3cfb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/89e994688e965813ec0a09fb30b87fb8cee06474",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/aa84ce8a78a1a5c10cdf9c7a5fb0c999fbc2c8d6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ae91ab710d8e309f6c9eba07ce0d9d0b5d9040f0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c9060caab4135dd660c4676d1ea33a6e0d3fc09d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d2c667cc18314c9bad3ec86ae071c0342132aa09",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix warning when putting transaction with qgroups enabled after abort\n\nIf we have a transaction abort with qgroups enabled we get a warning\ntriggered when doing the final put on the transaction, like this:\n\n  [552.6789] ------------[ cut here ]------------\n  [552.6815] WARNING: CPU: 4 PID: 81745 at fs/btrfs/transaction.c:144 btrfs_put_transaction+0x123/0x130 [btrfs]\n  [552.6817] Modules linked in: btrfs blake2b_generic xor (...)\n  [552.6819] CPU: 4 PID: 81745 Comm: btrfs-transacti Tainted: G        W          6.4.0-rc6-btrfs-next-134+ #1\n  [552.6819] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014\n  [552.6819] RIP: 0010:btrfs_put_transaction+0x123/0x130 [btrfs]\n  [552.6821] Code: bd a0 01 00 (...)\n  [552.6821] RSP: 0018:ffffa168c0527e28 EFLAGS: 00010286\n  [552.6821] RAX: ffff936042caed00 RBX: ffff93604a3eb448 RCX: 0000000000000000\n  [552.6821] RDX: ffff93606421b028 RSI: ffffffff92ff0878 RDI: ffff93606421b010\n  [552.6821] RBP: ffff93606421b000 R08: 0000000000000000 R09: ffffa168c0d07c20\n  [552.6821] R10: 0000000000000000 R11: ffff93608dc52950 R12: ffffa168c0527e70\n  [552.6821] R13: ffff93606421b000 R14: ffff93604a3eb420 R15: ffff93606421b028\n  [552.6821] FS:  0000000000000000(0000) GS:ffff93675fb00000(0000) knlGS:0000000000000000\n  [552.6821] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [552.6821] CR2: 0000558ad262b000 CR3: 000000014feda005 CR4: 0000000000370ee0\n  [552.6822] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n  [552.6822] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n  [552.6822] Call Trace:\n  [552.6822]  <TASK>\n  [552.6822]  ? __warn+0x80/0x130\n  [552.6822]  ? btrfs_put_transaction+0x123/0x130 [btrfs]\n  [552.6824]  ? report_bug+0x1f4/0x200\n  [552.6824]  ? handle_bug+0x42/0x70\n  [552.6824]  ? exc_invalid_op+0x14/0x70\n  [552.6824]  ? asm_exc_invalid_op+0x16/0x20\n  [552.6824]  ? btrfs_put_transaction+0x123/0x130 [btrfs]\n  [552.6826]  btrfs_cleanup_transaction+0xe7/0x5e0 [btrfs]\n  [552.6828]  ? _raw_spin_unlock_irqrestore+0x23/0x40\n  [552.6828]  ? try_to_wake_up+0x94/0x5e0\n  [552.6828]  ? __pfx_process_timeout+0x10/0x10\n  [552.6828]  transaction_kthread+0x103/0x1d0 [btrfs]\n  [552.6830]  ? __pfx_transaction_kthread+0x10/0x10 [btrfs]\n  [552.6832]  kthread+0xee/0x120\n  [552.6832]  ? __pfx_kthread+0x10/0x10\n  [552.6832]  ret_from_fork+0x29/0x50\n  [552.6832]  </TASK>\n  [552.6832] ---[ end trace 0000000000000000 ]---\n\nThis corresponds to this line of code:\n\n  void btrfs_put_transaction(struct btrfs_transaction *transaction)\n  {\n      (...)\n          WARN_ON(!RB_EMPTY_ROOT(\n                          &transaction->delayed_refs.dirty_extent_root));\n      (...)\n  }\n\nThe warning happens because btrfs_qgroup_destroy_extent_records(), called\nin the transaction abort path, we free all entries from the rbtree\n\"dirty_extent_root\" with rbtree_postorder_for_each_entry_safe(), but we\ndon't actually empty the rbtree - it's still pointing to nodes that were\nfreed.\n\nSo set the rbtree's root node to NULL to avoid this warning (assign\nRB_ROOT)."
    }
  ],
  "lastModified": "2026-06-17T06:46:12.703",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}