CVE-2025-71295

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-71295
In the Linux kernel, the following vulnerability has been resolved: fs/buffer: add alert in try_to_free_buffers() for folios without buffers try_to_free_buffers() can be called on folios with no buffers attached when filemap_release_folio() is invoked on a folio belonging to a mapping with AS_RELEASE_ALWAYS set but no release_folio operation defined. In such cases, folio_needs_release() returns true because of the AS_RELEASE_ALWAYS flag, but the folio has no private buffer data. This causes try_to_free_buffers() to call drop_buffers() on a folio with no buffers, leading to a null pointer dereference. Adding a check in try_to_free_buffers() to return early if the folio has no buffers attached, with WARN_ON_ONCE() to alert about the misconfiguration. This provides defensive hardening.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/1b111a69a6e33a922622bf9870e4e63fb2b649c8 Patch
https://git.kernel.org/stable/c/42c32d7571ccd8ef32351cac506f00b0fae99fd2 Patch
https://git.kernel.org/stable/c/727e5140e0cf83b4ce6a11b89bb73bff5d96f8f3 Patch
https://git.kernel.org/stable/c/b68f91ef3b3fe82ad78c417de71b675699a8467c Patch
https://git.kernel.org/stable/c/c1b6227555c52781178132b7a06466711855795c Patch
https://git.kernel.org/stable/c/c6246ca15999053d2632fbcc7b86e6eef7f077cb Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

14 Oct 2026, 13:10

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: fs/buffer: añadir alerta en try_to_free_buffers() para folios sin búferes try_to_free_buffers() puede ser llamada en folios sin búferes adjuntos cuando filemap_release_folio() es invocada en un folio perteneciente a un mapeo con AS_RELEASE_ALWAYS establecido pero sin operación release_folio definida. En tales casos, folio_needs_release() devuelve verdadero debido a la bandera AS_RELEASE_ALWAYS, pero el folio no tiene datos de búfer privados. Esto causa que try_to_free_buffers() llame a drop_buffers() en un folio sin búferes, lo que lleva a una desreferencia de puntero nulo. Añadiendo una comprobación en try_to_free_buffers() para retornar anticipadamente si el folio no tiene búferes adjuntos, con WARN_ON_ONCE() para alertar sobre la mala configuración. Esto proporciona un endurecimiento defensivo.
Information

Published : 2026-05-06 12:16

Updated : 2026-10-14 13:10

NVD link : CVE-2025-71295

Mitre link : CVE-2025-71295

CVE.ORG link : CVE-2025-71295

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference