« Volver al listado

CVE-2025-71184

Estado: AnalizadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix NULL dereference on root when tracing inode eviction

When evicting an inode the first thing we do is to setup tracing for it, which implies fetching the root's id. But in btrfs_evict_inode() the root might be NULL, as implied in the next check that we do in btrfs_evict_inode().

Hence, we either should set the ->root_objectid to 0 in case the root is NULL, or we move tracing setup after checking that the root is not NULL. Setting the rootid to 0 at least gives us the possibility to trace this call even in the case when the root is NULL, so that's the solution taken here.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-71184",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "1abe9b8a138c9988ba8f7bfded6453649a31541f",
              "lessThan": "64d8abd8c5305795a2b35fc96039d99d34f5e762",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1abe9b8a138c9988ba8f7bfded6453649a31541f",
              "lessThan": "582ba48e4a4c06fef6bdcf4e57b7b9af660bbd0c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1abe9b8a138c9988ba8f7bfded6453649a31541f",
              "lessThan": "99e057f3d3ef24b99a7b1d84e01dd1bd890098da",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1abe9b8a138c9988ba8f7bfded6453649a31541f",
              "lessThan": "f157dd661339fc6f5f2b574fe2429c43bd309534",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "include/trace/events/btrfs.h"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.39"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.39",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.66",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.6",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "include/trace/events/btrfs.h"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-01-31T12:16:03.673",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/582ba48e4a4c06fef6bdcf4e57b7b9af660bbd0c",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/64d8abd8c5305795a2b35fc96039d99d34f5e762",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/99e057f3d3ef24b99a7b1d84e01dd1bd890098da",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f157dd661339fc6f5f2b574fe2429c43bd309534",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix NULL dereference on root when tracing inode eviction\n\nWhen evicting an inode the first thing we do is to setup tracing for it,\nwhich implies fetching the root's id. But in btrfs_evict_inode() the\nroot might be NULL, as implied in the next check that we do in\nbtrfs_evict_inode().\n\nHence, we either should set the ->root_objectid to 0 in case the root is\nNULL, or we move tracing setup after checking that the root is not\nNULL. Setting the rootid to 0 at least gives us the possibility to trace\nthis call even in the case when the root is NULL, so that's the solution\ntaken here."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbtrfs: corrección de desreferencia de NULL en la raíz al rastrear el desalojo de inodos\n\nAl desalojar un inodo, lo primero que hacemos es configurar el rastreo para él, lo que implica obtener el ID de la raíz. Pero en btrfs_evict_inode(), la raíz podría ser NULL, como se implica en la siguiente comprobación que hacemos en btrfs_evict_inode().\n\nPor lo tanto, deberíamos establecer el ->root_objectid a 0 en caso de que la raíz sea NULL, o movemos la configuración del rastreo después de comprobar que la raíz no es NULL. Establecer el rootid a 0 al menos nos da la posibilidad de rastrear esta llamada incluso en el caso de que la raíz sea NULL, así que esa es la solución adoptada aquí."
    }
  ],
  "lastModified": "2026-06-17T10:03:50.620",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CCDB78D6-552E-48B6-AF60-2B44DD815BFF",
              "versionEndExcluding": "6.6.130",
              "versionStartIncluding": "2.6.39.1"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F72B884C-B44F-40E4-9895-CE421AC663D0",
              "versionEndExcluding": "6.12.66",
              "versionStartIncluding": "6.7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "879529BC-5B4C-4EBE-BF1D-1A31404A8B2E",
              "versionEndExcluding": "6.18.6",
              "versionStartIncluding": "6.13"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.39:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6691E95C-E563-4730-BC6E-5B1F208DF350"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EB5B7DFC-C36B-45D8-922C-877569FDDF43"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}