Skip to main content

Linux Kernel CVE-2025-71295

| EUVDEUVD-2025-209685 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-05-06 Linux GHSA-hv9q-ch73-572p
Denial Of Service Linux Null Pointer Dereference
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only attack path (AV:L); low privileges sufficient but no remote vector; impact confined to availability via kernel panic with no data exposure.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 00:40 vuln.today
CVSS changed
May 12, 2026 - 21:22 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:02 EUVD
CVE Published
May 06, 2026 - 11:32 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

fs/buffer: add alert in try_to_free_buffers() for folios without buffers

try_to_free_buffers() can be called on folios with no buffers attached when filemap_release_folio() is invoked on a folio belonging to a mapping with AS_RELEASE_ALWAYS set but no release_folio operation defined.

In such cases, folio_needs_release() returns true because of the AS_RELEASE_ALWAYS flag, but the folio has no private buffer data. This causes try_to_free_buffers() to call drop_buffers() on a folio with no buffers, leading to a null pointer dereference.

Adding a check in try_to_free_buffers() to return early if the folio has no buffers attached, with WARN_ON_ONCE() to alert about the misconfiguration. This provides defensive hardening.

AnalysisAI

Null pointer dereference in the Linux kernel's buffer cache subsystem (fs/buffer.c) can cause a kernel panic, resulting in a local denial of service. The flaw is triggered when try_to_free_buffers() calls drop_buffers() on a folio that has no buffer heads attached - a condition reachable when filemap_release_folio() is invoked on a mapping with AS_RELEASE_ALWAYS set but no release_folio operation defined. No public exploit has been identified and the EPSS score of 0.02% (7th percentile) confirms negligible observed exploitation activity; patched stable kernel releases are available across multiple branches.

Technical ContextAI

The vulnerable code resides in the Linux kernel's page/folio reclaim path (fs/buffer.c). The filemap_release_folio() function checks whether a folio needs release via folio_needs_release(), which returns true when the AS_RELEASE_ALWAYS flag is set on the address space - regardless of whether the folio actually holds private buffer data. When the address space has no release_folio operation defined, execution falls through to try_to_free_buffers(), which unconditionally calls drop_buffers(). With no buffer heads attached to the folio, drop_buffers() dereferences a null pointer, causing a kernel oops or panic. This is a textbook CWE-476 (NULL Pointer Dereference) resulting from a missing null check at a function boundary. The fix introduces a defensive early return with WARN_ON_ONCE() to surface the misconfiguration without crashing. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to a patched Linux kernel release: 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, or 7.0. The upstream stable fixes are available at https://git.kernel.org/stable/c/1b111a69a6e33a922622bf9870e4e63fb2b649c8 (and sibling commits c1b6227555c5, 727e5140e0cf, 42c32d7571cc, c6246ca15999, b68f91ef3b3f). Ubuntu users should apply USN-8492-1; Red Hat and SUSE users should consult their respective vendor security advisories. As a compensating control where patching is not immediately feasible, audit custom or third-party filesystem drivers and VFS address space implementations to ensure any mapping that sets AS_RELEASE_ALWAYS also implements a release_folio operation - this eliminates the triggering condition without a kernel upgrade, but requires application-level knowledge of in-use filesystems. Standard production filesystems (ext4, xfs, btrfs) are not expected to require this audit.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2025-71295 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy