Junglewise Threat Intelligence

CVE-2025-71295: Linux Kernel null pointer dereference in try_to_free_buffers

CVE-2025-71295 · Severity: medium · CVSS 5.5 · Published 2026-05-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's file system management could allow a local user to crash the system. The issue occurs when the system attempts to release memory associated with certain files that are not properly configured. This results in a system crash (kernel panic), which can disrupt operations and lead to a denial of service for all users on the affected machine.

Technical details

A NULL pointer dereference exists in the Linux kernel's fs/buffer.c component within the try_to_free_buffers() function. The vulnerability is triggered when filemap_release_folio() is called on a folio belonging to a mapping with the AS_RELEASE_ALWAYS flag set but no release_folio operation defined. In this specific misconfiguration, folio_needs_release() returns true, but the folio lacks private buffer data, causing try_to_free_buffers() to call drop_buffers() on a NULL reference. A local attacker can exploit this to cause a kernel panic (Denial of Service). The issue has been resolved by adding a defensive check and a WARN_ON_ONCE() alert in try_to_free_buffers() to handle folios without attached buffers.

Affected products

  • Linux Linux Kernel 6.1.72 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6

Timeline

  • 2025-12-11: other: Patch submitted by developer
  • 2026-05-06: disclosed: CVE published

References

Related threats