# CVE-2025-71069: f2fs: invalidate dentry cache on failed whiteout creation

> A local attacker can trigger a use-after-free in the F2FS filesystem via corrupted directory structures, potentially causing system crashes or privilege escalation.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 13 Jan 2026
- **Updated:** 11 May 2026
- **Also known as:** AZL-74489, BELL-CVE-2025-71069, DEBIAN-CVE-2025-71069, GHSA-cvp7-5q98-pf48, ROOT-OS-DEBIAN-11-CVE-2025-71069, ROOT-OS-DEBIAN-12-CVE-2025-71069, ROOT-OS-DEBIAN-13-CVE-2025-71069, ROOT-OS-UBUNTU-2204-CVE-2025-71069, ROOT-OS-UBUNTU-2404-CVE-2025-71069, UBUNTU-CVE-2025-71069

## What is CVE-2025-71069?

CVE-2025-71069 is an use after free vulnerability in Linux, published on 13 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: invalidate dentry cache on failed whiteout creation

F2FS can mount filesystems with corrupted directory depth values that
get runtime-clamped to MAX_DIR_HASH_DEPTH. When RENAME_WHITEOUT
operations are performed on such directories, f2fs_rename performs
directory modifications (updating target entry and deleting source
entry) before attempting to add the whiteout entry via f2fs_add_link.

If f2fs_add_link fails due to the corrupted directory structure, the
function returns an error to VFS, but the partial directory
modifications have already been committed to disk. VFS assumes the
entire rename operation failed and does not update the dentry cache,
leaving stale mappings.

In the error path, VFS does not call d_move() to update the dentry
cache. This results in new_dentry still pointing to the old inode
(new_inode) which has already had its i_nlink decremented to zero.
The stale cache causes subsequent operations to incorrectly reference
the freed inode.

This causes subsequent operations to use cached dentry information that
no longer matches the on-disk state. When a second rename targets the
same entry, VFS attempts to decrement i_nlink on the stale inode, which
may already have i_nlink=0, triggering a WARNING in drop_nlink().

Example sequence:
1. First rename (RENAME_WHITEOUT): file2 → file1
   - f2fs updates file1 entry on disk (points to inode 8)
   - f2fs deletes file2 entry on disk
   - f2fs_add_link(whiteout) fails (corrupted directory)
   - Returns error to VFS
   - VFS does not call d_move() due to error
   - VFS cache still has: file1 → inode 7 (stale!)
   - inode 7 has i_nlink=0 (already decremented)

2. Second rename: file3 → file1
   - VFS uses stale cache: file1 → inode 7
   - Tries to drop_nlink on inode 7 (i_nlink already 0)
   - WARNING in drop_nlink()

Fix this by explicitly invalidating old_dentry and new_dentry when
f2fs_add_link fails during whiteout creation. This forces VFS to
refresh from disk on subsequent operations, ensuring cache consistency
even when the rename partially succeeds.

Reproducer:
1. Mount F2FS image with corrupted i_current_depth
2. renameat2(file2, file1, RENAME_WHITEOUT)
3. renameat2(file3, file1, 0)
4. System triggers WARNING in drop_nlink()

## Which versions are affected by CVE-2025-71069?


## How do I fix CVE-2025-71069?

Apply the vendor's patch.

## Is CVE-2025-71069 being exploited?

There is no known exploitation of CVE-2025-71069 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2025-71069 and fix it if it is affected.

What it is: CVE-2025-71069 is an use after free vulnerability in Linux, published on 13 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2025-71069 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2025-71069/ (Markdown: https://insights.sbomify.com/CVE-2025-71069/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-71069
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-71069
- OSV: https://osv.dev/vulnerability/CVE-2025-71069

---
From sbomify Insights: https://insights.sbomify.com/CVE-2025-71069/
Summaries are generated and may contain mistakes; the official description above is the record.