CVE-2025-71269
Last modified
CVE-2025-71269 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: btrfs: do not free data reservation in fallback from inline due to -ENOSPC If we fail to create an inline extent due to -ENOSPC, we will attempt to go through the normal COW path, reserve an extent, create an ordered extent, etc. However we were always freeing the reserved qgroup data, which is wrong since we will use data. EPSS estimates a 0.11% chance of exploitation in the next 30 days.
Description
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not free data reservation in fallback from inline due to -ENOSPC If we fail to create an inline extent due to -ENOSPC, we will attempt to go through the normal COW path, reserve an extent, create an ordered extent, etc. However we were always freeing the reserved qgroup data, which is wrong since we will use data. Fix this by freeing the reserved qgroup data in __cow_file_range_inline() only if we are not doing the fallback (ret is <= 0).
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Linux | Linux Kernel | >= 4.4, < 6.1.168 | — |
| Linux | Linux Kernel | >= 6.2, < 6.6.134 | — |
| Linux | Linux Kernel | >= 6.7, < 6.12.81 | — |
| Linux | Linux Kernel | >= 6.13, < 6.18.10 | — |
| Linux | Linux Kernel | 6.19 | Rc1 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2025-71269?
How severe is CVE-2025-71269?
How do I fix CVE-2025-71269?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-71263In UNIX Fourth Research Edition (v4), the su command is vuln…7.8
- CVE-2025-71264Mumble before 1.6.870 is prone to an out-of-bounds array acc…5.3
- CVE-2025-71265In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2025-71266In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2025-71267In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2025-71268In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2025-7127A vulnerability, which was classified as critical, was found…7.2
- CVE-2025-71270In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2025-71271In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2025-71272In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2025-71273In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2025-71274In the Linux kernel, the following vulnerability has been re…4.7
Are you affected by CVE-2025-71269?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST