Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - btrfs修复尝试加入已中止事务时的释放后使用错误当我们尝试加入当前事务时如果该事务已中止则会在解锁 fs_info->trans_lock 后且不保留任何额外引用计数的情况下读取其“aborted”字段上的 。这意味着中止事务的并发任务可能在我们读取事务的“aborted”字段之前释放该事务从而导致释放后使用。
    请通过在保留 fs_info->trans_lock 时读取“aborted”字段来修复此问题因为任何释放任务在释放事务之前都必须首先获取该锁定并将 fs_info->running_transaction 设置为 NULL。此问题由 syzbot 和 Dmitry 使用 KASAN 中的以下堆栈跟踪报告
    ================================================== ================ BUGKASANjoin_transaction+0xd9b/0xda0 fs/btrfs/transaction.c:278 中的 slab 释放后使用在地址 ffff888011839024 大小为 4 的读取中由task kworker/u4:9/1128 CPU: 0 UID: 0 PID: 1128 Comm: kworker/u4:9 Not tainted 6.13.0-rc7-syzkaller-00019-gc45323b7560e #0 硬件名称QEMU Standard PC (Q35 + ICH9 、 2009、BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 工作队列events_unbound btrfs_async_reclaim_data_space 调用跟踪 <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 join_transaction+ 0xd9b/0xda0 fs/btrfs/transaction.c:278 start_transaction+0xaf8/0x1670 fs/btrfs/transaction.c:697 flush_space+0x448/0xcf0 fs/btrfs/space-info.c:803 btrfs_async_reclaim_data_space+0x159/0x510 fs/btrfs /space-info.c:1321 process_one_work kernel/workque ue.c:3236 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3317 worker_thread+0x870/0xd30 kernel/workqueue.c:3398 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch /x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> 由任务分配 5315: kasan_save_stack mm/kasan/common.c:47 [内联] kasan_save_track+0x3f/ 0x80 mm/kasan/common.c:68毒害_kmalloc_redzone mm/kasan/common.c:377 [内联] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [内联]
    __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329 kmalloc_noprof include/linux/slab.h:901 [inline] join_transaction+0x144/0xda0 fs/btrfs/transaction.c:308 start_transaction+0xaf8/0x1670 fs/btrfs/transaction。 c:697 btrfs_create_common+0x1b2/0x2e0 fs/btrfs/inode.c:6572 lookup_open fs/namei.c:3649 [内联] open_last_lookups fs/namei.c:3748 [内联] path_openat+0x1c03/0x3590 fs/namei.c第3984 do_filp_open+0x27f/0x4e0 fs/namei.c:4014 do_sys_openat2+0x13e/0x1d0 fs/open.c:1402 do_sys_open fs/open.c:1417 [内联] __do_sys_creat fs/open.c:1495 [inline] __se_sys_creat fs/ open.c:1489 [内联] __x64_sys_creat+0x123/0x170 fs/open.c:1489 do_syscall_x64 arch/x86/entry/common.c:52 [内联] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c 83 entry_SYSCALL_64_after_hwframe+0x77/0x7f 由任务 5336kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c 释放:582poison_slab_object mm/kasan/common.c:247 [内联]
    __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [内联] slab_free_hook mm/slub.c:2353 [内联] slab_free mm/slub.c:4613 [内联] kfree +0x196/0x430 mm/slub.c:4761 cleanup_transaction fs/btrfs/transaction.c:2063 [内联] btrfs_commit_transaction+0x2c97/0x3720 fs/btrfs/transaction.c:2598 insert_balance_item+0x1284/0x20b0 fs/btrfs/volumes.c 3757 btrfs_balance+0x992/
    ---truncated--- (CVE-2025-21753)

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

检测

Linux Distros 未修补的漏洞：CVE-2025-21753

high Nessus 插件 ID 231105

版本 1.12