CVE-2025-71295 (GCVE-0-2025-71295)

Vulnerability from cvelistv5 – Published: 2026-05-06 11:32 – Updated: 2026-05-23 16:03
VLAI
Title
fs/buffer: add alert in try_to_free_buffers() for folios without buffers
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/buffer: add alert in try_to_free_buffers() for folios without buffers try_to_free_buffers() can be called on folios with no buffers attached when filemap_release_folio() is invoked on a folio belonging to a mapping with AS_RELEASE_ALWAYS set but no release_folio operation defined. In such cases, folio_needs_release() returns true because of the AS_RELEASE_ALWAYS flag, but the folio has no private buffer data. This causes try_to_free_buffers() to call drop_buffers() on a folio with no buffers, leading to a null pointer dereference. Adding a check in try_to_free_buffers() to return early if the folio has no buffers attached, with WARN_ON_ONCE() to alert about the misconfiguration. This provides defensive hardening.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: d0eafc763135508be118dac208887a26c0adb74d , < 1b111a69a6e33a922622bf9870e4e63fb2b649c8 (git)
Affected: b4fa966f03b7401ceacd4ffd7227197afb2b8376 , < c1b6227555c52781178132b7a06466711855795c (git)
Affected: b4fa966f03b7401ceacd4ffd7227197afb2b8376 , < 727e5140e0cf83b4ce6a11b89bb73bff5d96f8f3 (git)
Affected: b4fa966f03b7401ceacd4ffd7227197afb2b8376 , < 42c32d7571ccd8ef32351cac506f00b0fae99fd2 (git)
Affected: b4fa966f03b7401ceacd4ffd7227197afb2b8376 , < c6246ca15999053d2632fbcc7b86e6eef7f077cb (git)
Affected: b4fa966f03b7401ceacd4ffd7227197afb2b8376 , < b68f91ef3b3fe82ad78c417de71b675699a8467c (git)
Affected: 6.1.72 , < 6.1.165 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.1.165 , ≤ 6.1.* (semver)
Unaffected: 6.6.128 , ≤ 6.6.* (semver)
Unaffected: 6.12.75 , ≤ 6.12.* (semver)
Unaffected: 6.18.16 , ≤ 6.18.* (semver)
Unaffected: 6.19.6 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1b111a69a6e33a922622bf9870e4e63fb2b649c8",
              "status": "affected",
              "version": "d0eafc763135508be118dac208887a26c0adb74d",
              "versionType": "git"
            },
            {
              "lessThan": "c1b6227555c52781178132b7a06466711855795c",
              "status": "affected",
              "version": "b4fa966f03b7401ceacd4ffd7227197afb2b8376",
              "versionType": "git"
            },
            {
              "lessThan": "727e5140e0cf83b4ce6a11b89bb73bff5d96f8f3",
              "status": "affected",
              "version": "b4fa966f03b7401ceacd4ffd7227197afb2b8376",
              "versionType": "git"
            },
            {
              "lessThan": "42c32d7571ccd8ef32351cac506f00b0fae99fd2",
              "status": "affected",
              "version": "b4fa966f03b7401ceacd4ffd7227197afb2b8376",
              "versionType": "git"
            },
            {
              "lessThan": "c6246ca15999053d2632fbcc7b86e6eef7f077cb",
              "status": "affected",
              "version": "b4fa966f03b7401ceacd4ffd7227197afb2b8376",
              "versionType": "git"
            },
            {
              "lessThan": "b68f91ef3b3fe82ad78c417de71b675699a8467c",
              "status": "affected",
              "version": "b4fa966f03b7401ceacd4ffd7227197afb2b8376",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.165",
              "status": "affected",
              "version": "6.1.72",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.128",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.165",
                  "versionStartIncluding": "6.1.72",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.128",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.16",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.6",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/buffer: add alert in try_to_free_buffers() for folios without buffers\n\ntry_to_free_buffers() can be called on folios with no buffers attached\nwhen filemap_release_folio() is invoked on a folio belonging to a mapping\nwith AS_RELEASE_ALWAYS set but no release_folio operation defined.\n\nIn such cases, folio_needs_release() returns true because of the\nAS_RELEASE_ALWAYS flag, but the folio has no private buffer data. This\ncauses try_to_free_buffers() to call drop_buffers() on a folio with no\nbuffers, leading to a null pointer dereference.\n\nAdding a check in try_to_free_buffers() to return early if the folio has no\nbuffers attached, with WARN_ON_ONCE() to alert about the misconfiguration.\nThis provides defensive hardening."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:03:35.695Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1b111a69a6e33a922622bf9870e4e63fb2b649c8"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1b6227555c52781178132b7a06466711855795c"
        },
        {
          "url": "https://git.kernel.org/stable/c/727e5140e0cf83b4ce6a11b89bb73bff5d96f8f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/42c32d7571ccd8ef32351cac506f00b0fae99fd2"
        },
        {
          "url": "https://git.kernel.org/stable/c/c6246ca15999053d2632fbcc7b86e6eef7f077cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/b68f91ef3b3fe82ad78c417de71b675699a8467c"
        }
      ],
      "title": "fs/buffer: add alert in try_to_free_buffers() for folios without buffers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71295",
    "datePublished": "2026-05-06T11:32:25.917Z",
    "dateReserved": "2026-05-06T11:31:45.510Z",
    "dateUpdated": "2026-05-23T16:03:35.695Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-71295",
      "date": "2026-09-22",
      "epss": "0.00123",
      "percentile": "0.02353"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/buffer.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "1b111a69a6e33a922622bf9870e4e63fb2b649c8",
                    "status": "affected",
                    "version": "d0eafc763135508be118dac208887a26c0adb74d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c1b6227555c52781178132b7a06466711855795c",
                    "status": "affected",
                    "version": "b4fa966f03b7401ceacd4ffd7227197afb2b8376",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "727e5140e0cf83b4ce6a11b89bb73bff5d96f8f3",
                    "status": "affected",
                    "version": "b4fa966f03b7401ceacd4ffd7227197afb2b8376",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "42c32d7571ccd8ef32351cac506f00b0fae99fd2",
                    "status": "affected",
                    "version": "b4fa966f03b7401ceacd4ffd7227197afb2b8376",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c6246ca15999053d2632fbcc7b86e6eef7f077cb",
                    "status": "affected",
                    "version": "b4fa966f03b7401ceacd4ffd7227197afb2b8376",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b68f91ef3b3fe82ad78c417de71b675699a8467c",
                    "status": "affected",
                    "version": "b4fa966f03b7401ceacd4ffd7227197afb2b8376",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.1.165",
                    "status": "affected",
                    "version": "6.1.72",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/buffer.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.6"
                  },
                  {
                    "lessThan": "6.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.165",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.128",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.75",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "F9C931B5-ABFF-44E0-8DB4-F03D0583BE81",
                    "versionEndExcluding": "6.1.165",
                    "versionStartIncluding": "6.1.72",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "851E9353-6C09-4CC9-877E-E09DB164A3C2",
                    "versionEndExcluding": "6.6.128",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BCE16369-98ED-41CF-8995-DFDC10B288D2",
                    "versionEndExcluding": "6.12.75",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B",
                    "versionEndExcluding": "6.18.16",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67",
                    "versionEndExcluding": "6.19.6",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/buffer: add alert in try_to_free_buffers() for folios without buffers\n\ntry_to_free_buffers() can be called on folios with no buffers attached\nwhen filemap_release_folio() is invoked on a folio belonging to a mapping\nwith AS_RELEASE_ALWAYS set but no release_folio operation defined.\n\nIn such cases, folio_needs_release() returns true because of the\nAS_RELEASE_ALWAYS flag, but the folio has no private buffer data. This\ncauses try_to_free_buffers() to call drop_buffers() on a folio with no\nbuffers, leading to a null pointer dereference.\n\nAdding a check in try_to_free_buffers() to return early if the folio has no\nbuffers attached, with WARN_ON_ONCE() to alert about the misconfiguration.\nThis provides defensive hardening."
          }
        ],
        "id": "CVE-2025-71295",
        "lastModified": "2026-06-17T10:04:01.593",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2026-05-06T12:16:28.820",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1b111a69a6e33a922622bf9870e4e63fb2b649c8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/42c32d7571ccd8ef32351cac506f00b0fae99fd2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/727e5140e0cf83b4ce6a11b89bb73bff5d96f8f3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b68f91ef3b3fe82ad78c417de71b675699a8467c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c1b6227555c52781178132b7a06466711855795c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c6246ca15999053d2632fbcc7b86e6eef7f077cb"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-476"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-03T14:58:49+00:00",
      "cve": "CVE-2025-71295",
      "id": "CVE-2025-71295",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fs/buffer: add alert in try_to_free_buffers() for folios without buffers",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-71295.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T13:46:13Z",
      "cve": "CVE-2025-71295",
      "id": "CVE-2025-71295",
      "initial_release_date": "2026-05-09T02:48:13Z",
      "product_status:known_affected": "17",
      "product_status:known_not_affected": "370",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-71295",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-71295.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.