{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2025-71069 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2025-71069 is an use after free vulnerability in Linux, published on 13 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-71069 and fix it if it is affected.\n\nWhat it is: CVE-2025-71069 is an use after free vulnerability in Linux, published on 13 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-71069 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-71069/ (Markdown: https://insights.sbomify.com/CVE-2025-71069/index.md)","id":"CVE-2025-71069","markdown":"https://insights.sbomify.com/CVE-2025-71069/index.md","name":"CVE-2025-71069","record":{"aliases":["AZL-74489","BELL-CVE-2025-71069","DEBIAN-CVE-2025-71069","GHSA-cvp7-5q98-pf48","ROOT-OS-DEBIAN-11-CVE-2025-71069","ROOT-OS-DEBIAN-12-CVE-2025-71069","ROOT-OS-DEBIAN-13-CVE-2025-71069","ROOT-OS-UBUNTU-2204-CVE-2025-71069","ROOT-OS-UBUNTU-2404-CVE-2025-71069","UBUNTU-CVE-2025-71069"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel filesystem","requires_auth":"low_privilege","summary":"A local attacker can trigger a use-after-free in the F2FS filesystem via corrupted directory structures, potentially causing system crashes or privilege escalation.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: invalidate dentry cache on failed whiteout creation\n\nF2FS can mount filesystems with corrupted directory depth values that\nget runtime-clamped to MAX_DIR_HASH_DEPTH. When RENAME_WHITEOUT\noperations are performed on such directories, f2fs_rename performs\ndirectory modifications (updating target entry and deleting source\nentry) before attempting to add the whiteout entry via f2fs_add_link.\n\nIf f2fs_add_link fails due to the corrupted directory structure, the\nfunction returns an error to VFS, but the partial directory\nmodifications have already been committed to disk. VFS assumes the\nentire rename operation failed and does not update the dentry cache,\nleaving stale mappings.\n\nIn the error path, VFS does not call d_move() to update the dentry\ncache. This results in new_dentry still pointing to the old inode\n(new_inode) which has already had its i_nlink decremented to zero.\nThe stale cache causes subsequent operations to incorrectly reference\nthe freed inode.\n\nThis causes subsequent operations to use cached dentry information that\nno longer matches the on-disk state. When a second rename targets the\nsame entry, VFS attempts to decrement i_nlink on the stale inode, which\nmay already have i_nlink=0, triggering a WARNING in drop_nlink().\n\nExample sequence:\n1. First rename (RENAME_WHITEOUT): file2 → file1\n   - f2fs updates file1 entry on disk (points to inode 8)\n   - f2fs deletes file2 entry on disk\n   - f2fs_add_link(whiteout) fails (corrupted directory)\n   - Returns error to VFS\n   - VFS does not call d_move() due to error\n   - VFS cache still has: file1 → inode 7 (stale!)\n   - inode 7 has i_nlink=0 (already decremented)\n\n2. Second rename: file3 → file1\n   - VFS uses stale cache: file1 → inode 7\n   - Tries to drop_nlink on inode 7 (i_nlink already 0)\n   - WARNING in drop_nlink()\n\nFix this by explicitly invalidating old_dentry and new_dentry when\nf2fs_add_link fails during whiteout creation. This forces VFS to\nrefresh from disk on subsequent operations, ensuring cache consistency\neven when the rename partially succeeds.\n\nReproducer:\n1. Mount F2FS image with corrupted i_current_depth\n2. renameat2(file2, file1, RENAME_WHITEOUT)\n3. renameat2(file3, file1, 0)\n4. System triggers WARNING in drop_nlink()","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"f2fs: invalidate dentry cache on failed whiteout creation","id":"CVE-2025-71069","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2025"},"n_packages":0,"n_references":7,"next":{"headline":"ublk: clean up user copy references on ublk server exit","id":"CVE-2025-71070"},"packages":[],"prev":{"headline":"svcrdma: bound check rq_pages index in inline path","id":"CVE-2025-71068"},"products":["Linux"],"published":"2026-01-13","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-05-11","vendors":["Linux"]},"summary":"A local attacker can trigger a use-after-free in the F2FS filesystem via corrupted directory structures, potentially causing system crashes or privilege escalation.","url":"https://insights.sbomify.com/CVE-2025-71069/"}