Linux Kernel CVE-2025-68359

Exploitation requires local access to a system running btrfs with quota groups (qgroups) enabled, since the flaw lives in the btrfs qgroup tracing / delayed-reference path (btrfs_qgroup_trace_extent_nolock and add_delayed_ref_head). The specific trigger is a qgroup record being reported as already existing followed by an error return from add_delayed_ref_head(), so an attacker must reach this uncommon error condition - a strong limiting factor. Limiting factors: the vulnerability is not reachable remotely, does not apply to non-btrfs filesystems or btrfs volumes without qgroups active, and depends on hitting an error path that is not exercised in normal operation, making reliable exploitation difficult.

The signals conflict sharply and must be weighed. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, score 9.8) is the automated, worst-case scoring commonly auto-assigned to Linux kernel CVEs and is not credible here: a double free inside btrfs delayed-ref/qgroup handling is triggered by local filesystem operations, not over the network, and requires reaching an uncommon error path after a record-already-exists condition, so real attack complexity is high. Corroborating this lower real-world risk, EPSS is only 0.17% (7th percentile), there is no KEV listing, and no public exploit is identified. This is therefore NOT a network RCE despite the headline score; it is a local memory-corruption issue whose practical exploitability (crash/DoS versus escalation) is unproven. Verify with the vendor: CVSS indicates AV:N/PR:N but the description clearly implies local access to a btrfs volume with qgroups active.

A local user or a process performing intensive btrfs metadata operations on a volume with quota groups enabled triggers the record-already-exists condition and then forces or races an add_delayed_ref_head() failure, causing the same qrecord to be freed twice. The resulting heap corruption most plausibly crashes the kernel (denial of service), with potential - but unproven - escalation to arbitrary kernel code execution. No public proof-of-concept is available and the required error path makes reliable triggering difficult.