CVE-2025-71295
Null pointer dereference in Linux kernel filesystem buffers
Publication date: 2026-05-06
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux_kernel | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's buffer management system. Specifically, the function try_to_free_buffers() can be called on memory folios that have no buffers attached. This happens when filemap_release_folio() is invoked on a folio belonging to a mapping with the AS_RELEASE_ALWAYS flag set but without a defined release_folio operation.
Because folio_needs_release() returns true due to the AS_RELEASE_ALWAYS flag, try_to_free_buffers() attempts to free buffers by calling drop_buffers() even though the folio has no private buffer data. This leads to a null pointer dereference, which can cause a kernel crash or instability.
The fix involves adding a check in try_to_free_buffers() to return early if the folio has no buffers attached, along with a warning alert (WARN_ON_ONCE()) to indicate the misconfiguration. This change provides defensive hardening against this issue.
How can this vulnerability impact me? :
This vulnerability can lead to a null pointer dereference in the Linux kernel, which may cause the system to crash or become unstable. Such crashes can result in denial of service, potentially interrupting normal operations and affecting system availability.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves a null pointer dereference in the Linux kernel's try_to_free_buffers() function when called on folios without buffers attached. Detection would typically involve monitoring kernel logs for WARN_ON_ONCE() alerts triggered by this condition.
You can check your system logs (e.g., using dmesg or journalctl) for warnings related to try_to_free_buffers or buffer management issues.
- Run: dmesg | grep -i 'try_to_free_buffers'
- Run: journalctl -k | grep -i 'try_to_free_buffers'
Since this is a kernel-level issue, there are no specific network commands to detect it. Detection relies on kernel log analysis.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved by adding a check in try_to_free_buffers() to return early if the folio has no buffers attached, preventing the null pointer dereference.
Immediate mitigation steps include updating your Linux kernel to a version that contains this fix.
If updating immediately is not possible, monitor kernel logs for WARN_ON_ONCE() alerts related to this issue to detect potential exploitation attempts.