CVE-2025-71295 fs/buffer: add alert in try_to_free_buffers() for folios without buffers
A null pointer dereference in the Linux kernel's buffer management can cause a system crash when specific filesystem flags are set without a release operation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-71295?
CVE-2025-71295 is a medium-severity vulnerability in Linux kernel, published on 6 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
fs/buffer: add alert in try_to_free_buffers() for folios without buffers
try_to_free_buffers() can be called on folios with no buffers attached when filemap_release_folio() is invoked on a folio belonging to a mapping with AS_RELEASE_ALWAYS set but no release_folio operation defined.
In such cases, folio_needs_release() returns true because of the AS_RELEASE_ALWAYS flag, but the folio has no private buffer data. This causes try_to_free_buffers() to call drop_buffers() on a folio with no buffers, leading to a null pointer dereference.
Adding a check in try_to_free_buffers() to return early if the folio has no buffers attached, with WARN_ON_ONCE() to alert about the misconfiguration. This provides defensive hardening.
Weakness: CWE-476
Which versions are affected by CVE-2025-71295?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-71295?
Apply the vendor's patch.
Is CVE-2025-71295 being exploited?
There is no known exploitation of CVE-2025-71295 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-71295, DEBIAN-CVE-2025-71295, GHSA-hv9q-ch73-572p, ROOT-OS-DEBIAN-11-CVE-2025-71295, ROOT-OS-UBUNTU-2204-CVE-2025-71295, ROOT-OS-UBUNTU-2404-CVE-2025-71295 and 1 more.