GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-71072 (GCVE-0-2025-71072)

Vulnerability from cvelistv5 – Published: 2026-01-13 15:31 – Updated: 2026-08-05 12:11
VLAI
Title
shmem: fix recovery on rename failures
Summary
In the Linux kernel, the following vulnerability has been resolved: shmem: fix recovery on rename failures maple_tree insertions can fail if we are seriously short on memory; simple_offset_rename() does not recover well if it runs into that. The same goes for simple_offset_rename_exchange(). Moreover, shmem_whiteout() expects that if it succeeds, the caller will progress to d_move(), i.e. that shmem_rename2() won't fail past the successful call of shmem_whiteout(). Not hard to fix, fortunately - mtree_store() can't fail if the index we are trying to store into is already present in the tree as a singleton. For simple_offset_rename_exchange() that's enough - we just need to be careful about the order of operations. For simple_offset_rename() solution is to preinsert the target into the tree for new_dir; the rest can be done without any potentially failing operations. That preinsertion has to be done in shmem_rename2() rather than in simple_offset_rename() itself - otherwise we'd need to deal with the possibility of failure after successful shmem_whiteout().
Severity
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a2e459555c5f9da3e619b7e47a63f98574dc75f1 , < 4b0fe71fb3965d0db83cdfc2f4fe0b3227d70113 (git)
Affected: a2e459555c5f9da3e619b7e47a63f98574dc75f1 , < 4642686699a46718d7f2fb5acd1e9d866a9d9cca (git)
Affected: a2e459555c5f9da3e619b7e47a63f98574dc75f1 , < e1b4c6a58304fd490124cc2b454d80edc786665c (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.6
Unaffected: 0 , < 6.6 (semver)
Unaffected: 6.12.64 , ≤ 6.12.* (semver)
Unaffected: 6.18.3 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/libfs.c",
            "include/linux/fs.h",
            "mm/shmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4b0fe71fb3965d0db83cdfc2f4fe0b3227d70113",
              "status": "affected",
              "version": "a2e459555c5f9da3e619b7e47a63f98574dc75f1",
              "versionType": "git"
            },
            {
              "lessThan": "4642686699a46718d7f2fb5acd1e9d866a9d9cca",
              "status": "affected",
              "version": "a2e459555c5f9da3e619b7e47a63f98574dc75f1",
              "versionType": "git"
            },
            {
              "lessThan": "e1b4c6a58304fd490124cc2b454d80edc786665c",
              "status": "affected",
              "version": "a2e459555c5f9da3e619b7e47a63f98574dc75f1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/libfs.c",
            "include/linux/fs.h",
            "mm/shmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.3",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nshmem: fix recovery on rename failures\n\nmaple_tree insertions can fail if we are seriously short on memory;\nsimple_offset_rename() does not recover well if it runs into that.\nThe same goes for simple_offset_rename_exchange().\n\nMoreover, shmem_whiteout() expects that if it succeeds, the caller will\nprogress to d_move(), i.e. that shmem_rename2() won\u0027t fail past the\nsuccessful call of shmem_whiteout().\n\nNot hard to fix, fortunately - mtree_store() can\u0027t fail if the index we\nare trying to store into is already present in the tree as a singleton.\n\nFor simple_offset_rename_exchange() that\u0027s enough - we just need to be\ncareful about the order of operations.\n\nFor simple_offset_rename() solution is to preinsert the target into the\ntree for new_dir; the rest can be done without any potentially failing\noperations.\n\nThat preinsertion has to be done in shmem_rename2() rather than in\nsimple_offset_rename() itself - otherwise we\u0027d need to deal with the\npossibility of failure after successful shmem_whiteout()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - A remote NFS client can invoke ordinary RENAME on a writable tmpfs export through nfsd, reaching shmem_rename2() and the vulnerable offset helpers.\nAC:L - The failure requires severe memory pressure, but an attacker with write access to tmpfs can create files and consume memory while repeatedly attempting renames.\nPR:N - A reasonably configured anonymous writable NFS export can accept AUTH_NULL or mapped AUTH_SYS clients without prior authentication, subject only to directory write and search permissions.\nUI:N - The attacker directly sends rename operations and does not require a victim to perform any action.\nS:U - The corrupted directory state and resulting denial of service remain within the host kernel and filesystem security authority.\nC:N - The failure loses directory-offset mappings but creates no stale freed-object access, out-of-bounds read, or other information-disclosure primitive.\nI:L - A failed insertion can persistently desynchronize a live dentry from its maple-tree mapping, corrupting directory metadata and cookies, but it does not provide arbitrary data modification.\nA:H - The corrupted offsets can make local getdents or NFS READDIR repeat, omit, or fail to progress through entries, potentially rendering the exported directory unavailable to clients."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:11:52.290Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4b0fe71fb3965d0db83cdfc2f4fe0b3227d70113"
        },
        {
          "url": "https://git.kernel.org/stable/c/4642686699a46718d7f2fb5acd1e9d866a9d9cca"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1b4c6a58304fd490124cc2b454d80edc786665c"
        }
      ],
      "title": "shmem: fix recovery on rename failures",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71072",
    "datePublished": "2026-01-13T15:31:26.089Z",
    "dateReserved": "2026-01-13T15:30:19.647Z",
    "dateUpdated": "2026-08-05T12:11:52.290Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-71072",
      "date": "2026-09-16",
      "epss": "0.00282",
      "percentile": "0.20729"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:45:07.000Z",
      "cve": "CVE-2025-71072",
      "id": "msrc_CVE-2025-71072",
      "initial_release_date": "2026-01-15T01:04:59.000Z",
      "product_status:known_affected": "14",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "shmem: fix recovery on rename failures",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2025-71072.json",
      "version": "16"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-71072\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-01-13T16:16:06.633\",\"lastModified\":\"2026-07-30T06:24:48.857\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nshmem: fix recovery on rename failures\\n\\nmaple_tree insertions can fail if we are seriously short on memory;\\nsimple_offset_rename() does not recover well if it runs into that.\\nThe same goes for simple_offset_rename_exchange().\\n\\nMoreover, shmem_whiteout() expects that if it succeeds, the caller will\\nprogress to d_move(), i.e. that shmem_rename2() won\u0027t fail past the\\nsuccessful call of shmem_whiteout().\\n\\nNot hard to fix, fortunately - mtree_store() can\u0027t fail if the index we\\nare trying to store into is already present in the tree as a singleton.\\n\\nFor simple_offset_rename_exchange() that\u0027s enough - we just need to be\\ncareful about the order of operations.\\n\\nFor simple_offset_rename() solution is to preinsert the target into the\\ntree for new_dir; the rest can be done without any potentially failing\\noperations.\\n\\nThat preinsertion has to be done in shmem_rename2() rather than in\\nsimple_offset_rename() itself - otherwise we\u0027d need to deal with the\\npossibility of failure after successful shmem_whiteout().\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nshmem: corrige la recuperaci\u00f3n en fallos de renombrado\\n\\nLas inserciones de maple_tree pueden fallar si tenemos una escasez grave de memoria; simple_offset_rename() no se recupera bien si se encuentra con eso. Lo mismo ocurre con simple_offset_rename_exchange().\\n\\nAdem\u00e1s, shmem_whiteout() espera que, si tiene \u00e9xito, el llamador avance a d_move(), es decir, que shmem_rename2() no falle despu\u00e9s de la llamada exitosa de shmem_whiteout().\\n\\nNo es dif\u00edcil de arreglar, afortunadamente: mtree_store() no puede fallar si el \u00edndice en el que estamos intentando almacenar ya est\u00e1 presente en el \u00e1rbol como un singleton.\\n\\nPara simple_offset_rename_exchange() eso es suficiente; solo necesitamos tener cuidado con el orden de las operaciones.\\n\\nPara simple_offset_rename() la soluci\u00f3n es preinsertar el objetivo en el \u00e1rbol para new_dir; el resto se puede hacer sin ninguna operaci\u00f3n que pueda fallar.\\n\\nEsa preinserci\u00f3n tiene que hacerse en shmem_rename2() en lugar de en simple_offset_rename() mismo; de lo contrario, necesitar\u00edamos lidiar con la posibilidad de fallo despu\u00e9s de un shmem_whiteout() exitoso.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/libfs.c\",\"include/linux/fs.h\",\"mm/shmem.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a2e459555c5f9da3e619b7e47a63f98574dc75f1\",\"lessThan\":\"4b0fe71fb3965d0db83cdfc2f4fe0b3227d70113\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a2e459555c5f9da3e619b7e47a63f98574dc75f1\",\"lessThan\":\"4642686699a46718d7f2fb5acd1e9d866a9d9cca\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a2e459555c5f9da3e619b7e47a63f98574dc75f1\",\"lessThan\":\"e1b4c6a58304fd490124cc2b454d80edc786665c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/libfs.c\",\"include/linux/fs.h\",\"mm/shmem.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.64\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.3\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":4.2},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.6.1\",\"versionEndExcluding\":\"6.12.64\",\"matchCriteriaId\":\"44DC6A0C-1CDA-49FB-A889-9025B3D5827A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.3\",\"matchCriteriaId\":\"2DC484D8-FB4F-4112-900F-AE333B6FE7A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.6:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"E346B162-D566-4E62-ABDE-ECBFB21B8BFD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F71D92C0-C023-48BD-B3B6-70B638EEE298\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"13580667-0A98-40CC-B29F-D12790B91BDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EF854A1-ABB1-4E93-BE9A-44569EC76C0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB5B7DFC-C36B-45D8-922C-877569FDDF43\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4642686699a46718d7f2fb5acd1e9d866a9d9cca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4b0fe71fb3965d0db83cdfc2f4fe0b3227d70113\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e1b4c6a58304fd490124cc2b454d80edc786665c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-11T15:33:07+00:00",
      "cve": "CVE-2025-71072",
      "id": "CVE-2025-71072",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:fixed": "309",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "184",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: shmem: fix recovery on rename failures",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-71072.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T01:48:25Z",
      "cve": "CVE-2025-71072",
      "id": "CVE-2025-71072",
      "initial_release_date": "2026-01-14T00:25:57Z",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "433",
      "product_status:recommended": "42",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-71072",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-71072.json",
      "version": "14"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.