Memory Leak Vulnerability in Btrfs File System by Linux Kernel

CVE-2025-40209

What is CVE-2025-40209?

A memory leak vulnerability exists in the Btrfs file system within the Linux Kernel, specifically in the function btrfs_add_qgroup_relation(). The issue arises when invalid qgroup levels are provided, causing the function to return an error without releasing a preallocated qgroup_list structure. This oversight results in a memory leak, as the pointer to the structure cannot be cleaned up effectively by the caller. Unprivileged users with write access to a Btrfs mount can exploit this flaw to exhaust system memory by repeatedly triggering the leak.

References