CVE-2025-71292 jfs: nlink overflow in jfs_rename
An integer overflow in the JFS filesystem rename operation can cause a warning and potential denial of service when handling directories with maximum link counts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-71292?
CVE-2025-71292 is a high-severity vulnerability in Linux kernel, published on 6 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
jfs: nlink overflow in jfs_rename
If nlink is maximal for a directory (-1) and inside that directory you perform a rename for some child directory (not moving from the parent), then the nlink of the first directory is first incremented and later decremented. Normally this is fine, but when nlink = -1 this causes a wrap around to 0, and then drop_nlink issues a warning.
After applying the patch syzbot no longer issues any warnings. I also ran some basic fs tests to look for any regressions.
Which versions are affected by CVE-2025-71292?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-71292?
Apply the vendor's patch.
Is CVE-2025-71292 being exploited?
There is no known exploitation of CVE-2025-71292 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-71292, DEBIAN-CVE-2025-71292, GHSA-469f-r242-gq7h, ROOT-OS-DEBIAN-11-CVE-2025-71292, ROOT-OS-UBUNTU-2204-CVE-2025-71292, ROOT-OS-UBUNTU-2404-CVE-2025-71292 and 1 more.