# CVE-2025-37931: btrfs: adjust subpage bit start based on sectorsize > A logic error in the Linux kernel's btrfs filesystem causes tree log corruption and potential denial of service on systems with specific page and node size configurations. - **Severity:** High 7.3 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H`) - **Exploited in the wild:** Not known - **Login needed:** Any signed-in user - **Attackable:** Local or same network only - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 20 May 2025 - **Updated:** 5 Aug 2026 - **Also known as:** AZL-62654, AZL-72823, BELL-CVE-2025-37931, DEBIAN-CVE-2025-37931, GHSA-v9hh-vwqw-fc9h, ROOT-OS-DEBIAN-12-CVE-2025-37931, ROOT-OS-UBUNTU-2204-CVE-2025-37931, ROOT-OS-UBUNTU-2404-CVE-2025-37931, UBUNTU-CVE-2025-37931 ## What is CVE-2025-37931? CVE-2025-37931 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 20 May 2025. It can only be exploited from the same machine or local network, with no action from the victim. ### Official description In the Linux kernel, the following vulnerability has been resolved: btrfs: adjust subpage bit start based on sectorsize When running machines with 64k page size and a 16k nodesize we started seeing tree log corruption in production. This turned out to be because we were not writing out dirty blocks sometimes, so this in fact affects all metadata writes. When writing out a subpage EB we scan the subpage bitmap for a dirty range. If the range isn't dirty we do bit_start++; to move onto the next bit. The problem is the bitmap is based on the number of sectors that an EB has. So in this case, we have a 64k pagesize, 16k nodesize, but a 4k sectorsize. This means our bitmap is 4 bits for every node. With a 64k page size we end up with 4 nodes per page. To make this easier this is how everything looks [0 16k 32k 48k ] logical address [0 4 8 12 ] radix tree offset [ 64k page ] folio [ 16k eb ][ 16k eb ][ 16k eb ][ 16k eb ] extent buffers [ | | | | | | | | | | | | | | | | ] bitmap Now we use all of our addressing based on fs_info->sectorsize_bits, so as you can see the above our 16k eb->start turns into radix entry 4. When we find a dirty range for our eb, we correctly do bit_start += sectors_per_node, because if we start at bit 0, the next bit for the next eb is 4, to correspond to eb->start 16k. However if our range is clean, we will do bit_start++, which will now put us offset from our radix tree entries. In our case, assume that the first time we check the bitmap the block is not dirty, we increment bit_start so now it == 1, and then we loop around and check again. This time it is dirty, and we go to find that start using the following equation start = folio_start + bit_start * fs_info->sectorsize; so in the case above, eb->start 0 is now dirty, and we calculate start as 0 + 1 * fs_info->sectorsize = 4096 4096 >> 12 = 1 Now we're looking up the radix tree for 1, and we won't find an eb. What's worse is now we're using bit_start == 1, so we do bit_start += sectors_per_node, which is now 5. If that eb is dirty we will run into the same thing, we will look at an offset that is not populated in the radix tree, and now we're skipping the writeout of dirty extent buffers. The best fix for this is to not use sectorsize_bits to address nodes, but that's a larger change. Since this is a fs corruption problem fix it simply by always using sectors_per_node to increment the start bit. ## Which versions are affected by CVE-2025-37931? It affects 2 products. Products: Debian Debian Linux, Linux kernel. ## How do I fix CVE-2025-37931? Apply the vendor's patch. ## Is CVE-2025-37931 being exploited? There is no known exploitation of CVE-2025-37931 in the wild and no public exploit code. ## Other vulnerabilities in Debian Debian Linux - [CVE-2015-3306](https://insights.sbomify.com/CVE-2015-3306/): ProFTPD Improper Access Control (critical 10.0, exploited in the wild) - [CVE-2025-49113](https://insights.sbomify.com/CVE-2025-49113/): RoundCube Webmail Deserialization of Untrusted Data (critical 9.9, exploited in the wild) - [CVE-2026-24061](https://insights.sbomify.com/CVE-2026-24061/): GNU InetUtils Argument Injection (critical 9.8, exploited in the wild) - [CVE-2025-39682](https://insights.sbomify.com/CVE-2025-39682/): Linux Kernel Improper Check for Unusual or Exceptional Conditions (critical 9.8, exploited in the wild) - [CVE-2024-9680](https://insights.sbomify.com/CVE-2024-9680/): Mozilla Firefox Use-After-Free (critical 9.8, exploited in the wild) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2025-37931 and fix it if it is affected. What it is: CVE-2025-37931 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 20 May 2025. It can only be exploited from the same machine or local network, with no action from the victim. Exploitation: There is no known exploitation of CVE-2025-37931 in the wild and no public exploit code. Affected product: Debian Debian Linux. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2025-37931/ (Markdown: https://insights.sbomify.com/CVE-2025-37931/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2025-37931 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-37931 - OSV: https://osv.dev/vulnerability/CVE-2025-37931 --- From sbomify Insights: https://insights.sbomify.com/CVE-2025-37931/ Summaries are generated and may contain mistakes; the official description above is the record.