CVE-2025-71269

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-71269
In the Linux kernel, the following vulnerability has been resolved: btrfs: do not free data reservation in fallback from inline due to -ENOSPC If we fail to create an inline extent due to -ENOSPC, we will attempt to go through the normal COW path, reserve an extent, create an ordered extent, etc. However we were always freeing the reserved qgroup data, which is wrong since we will use data. Fix this by freeing the reserved qgroup data in __cow_file_range_inline() only if we are not doing the fallback (ret is <= 0).

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0a1fbbd780f04d1b6cf48dd327c866ba937de1c4 Patch
https://git.kernel.org/stable/c/3a9fd45afadec1fbfec72057b9473d509fa8b68c Patch
https://git.kernel.org/stable/c/3edd1f6c7c520536b62b2904807033597554dbac Patch
https://git.kernel.org/stable/c/6de3a371a8b9fd095198b1aa68c22cc10a4c6961 Patch
https://git.kernel.org/stable/c/f8da41de0bff9eb1d774a7253da0c9f637c4470a Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
History

21 May 2026, 18:38

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE NVD-CWE-noinfo
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/0a1fbbd780f04d1b6cf48dd327c866ba937de1c4 - () https://git.kernel.org/stable/c/0a1fbbd780f04d1b6cf48dd327c866ba937de1c4 - Patch
References () https://git.kernel.org/stable/c/3a9fd45afadec1fbfec72057b9473d509fa8b68c - () https://git.kernel.org/stable/c/3a9fd45afadec1fbfec72057b9473d509fa8b68c - Patch
References () https://git.kernel.org/stable/c/3edd1f6c7c520536b62b2904807033597554dbac - () https://git.kernel.org/stable/c/3edd1f6c7c520536b62b2904807033597554dbac - Patch
References () https://git.kernel.org/stable/c/6de3a371a8b9fd095198b1aa68c22cc10a4c6961 - () https://git.kernel.org/stable/c/6de3a371a8b9fd095198b1aa68c22cc10a4c6961 - Patch
References () https://git.kernel.org/stable/c/f8da41de0bff9eb1d774a7253da0c9f637c4470a - () https://git.kernel.org/stable/c/f8da41de0bff9eb1d774a7253da0c9f637c4470a - Patch

11 Apr 2026, 13:16

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: btrfs: no liberar la reserva de datos en la alternativa de inline debido a -ENOSPC Si fallamos al crear una extensión inline debido a -ENOSPC, intentaremos seguir la ruta COW normal, reservar una extensión, crear una extensión ordenada, etc. Sin embargo, siempre estábamos liberando los datos qgroup reservados, lo cual es incorrecto ya que usaremos los datos. Corregir esto liberando los datos qgroup reservados en __cow_file_range_inline() solo si no estamos realizando la alternativa (ret es &lt;= 0).
References
  • () https://git.kernel.org/stable/c/0a1fbbd780f04d1b6cf48dd327c866ba937de1c4 -
  • () https://git.kernel.org/stable/c/3a9fd45afadec1fbfec72057b9473d509fa8b68c -
  • () https://git.kernel.org/stable/c/3edd1f6c7c520536b62b2904807033597554dbac -

18 Mar 2026, 18:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-18 18:16

Updated : 2026-05-21 18:38

NVD link : CVE-2025-71269

Mitre link : CVE-2025-71269

CVE.ORG link : CVE-2025-71269

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo