PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-71194 Linux CVE debrief

A deadlock vulnerability was found in the Linux kernel's btrfs module, specifically in the wait_current_trans() function. This issue arises when the function ignores the transaction type, potentially leading to a deadlock scenario involving two transactions and pending ordered extents. The btrfs_blocked_trans_types[] array defines which transaction types should wait for which transaction states, but this check was missing in wait_current_trans(). A deadlock scenario can occur as follows: 1. Transaction A is in TRANS_STATE_COMMIT_DOING state. 2. A worker processing an ordered extent calls start_transaction() with TRANS_JOIN. 3. join_transaction() returns -EBUSY because Transaction A

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-02-04
Original CVE updated
2026-10-19
Advisory published
2026-02-04
Advisory updated
2026-10-19

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of the btrfs module should assess exposure and prioritize verification of affected systems. The vulnerability requires verification of affected systems and application of patches to prevent potential denial of service. Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems, especially those using btrfs.

Why it matters

A deadlock vulnerability in the Linux kernel's btrfs module requires verification of affected systems and application of patches to prevent potential denial of service.

  • Potential denial of service due to deadlock
  • Verification of affected systems and applied patches required
  • Monitoring system logs for potential deadlock scenarios recommended

Technical summary

The vulnerability is caused by the wait_current_trans() function ignoring the transaction type, which can lead to a deadlock scenario. The issue is resolved by considering the transaction type in the wait_current_trans() function. The btrfs_blocked_trans_types[] array defines which transaction types should wait for which transaction states. The deadlock scenario can occur when two transactions and pending ordered extents are involved. The vulnerability requires verification of affected systems and application of patches to prevent potential denial of service.

Defensive priority

Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems, especially those using btrfs.

Recommended defensive actions

  • Review and apply the provided patches to the Linux kernel
  • Verify the system's Linux kernel version and check for exposure
  • Monitor system logs for potential deadlock scenarios
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, including a description of the issue and references to relevant commits. The Linux kernel maintainers and users should assess exposure and prioritize verification of affected systems, especially those using btrfs. The National Vulnerability Database (NVD) provides additional information on the vulnerability. The source item provides details on the vulnerability. The official CVE Program record with source-provided CVE metadata is available. The official NIST NVD

Sources and references

Verified primary and authoritative sources

  • CVE-2025-71194 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-71194

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-71194 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-71194

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • btrfs: fix deadlock in wait_current_trans() due to ignored transaction type

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/71xxx/CVE-2025-71194.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e563f59395981fcd69d130761290929806e728d6

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/dc84036c173cff6a432d9ab926298850b1d2a659

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d7b04b40ac8e6d814e35202a0e1568809b818295

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/99da896614d17e8a84aeb2b2d464ac046cc8633d

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8b0bb145d3bc264360f525c9717653be3522e528

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/9ac63333d600732a56b35ee1fa46836da671eb50

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5037b342825df7094a4906d1e2a9674baab50cb2

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.