{"id":"CVE-2025-71295","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/buffer: add alert in try_to_free_buffers() for folios without buffers\n\ntry_to_free_buffers() can be called on folios with no buffers attached\nwhen filemap_release_fo…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nfs/buffer: add alert in try_to_free_buffers() for folios without buffers\n\ntry_to_free_buffers() can be called on folios with no buffers attached\nwhen filemap_release_fo…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-476"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 6.1.72, < 6.1.165","linux_kernel >= 6.2, < 6.6.128","linux_kernel >= 6.7, < 6.12.75","linux_kernel >= 6.13, < 6.18.16","linux_kernel >= 6.19, < 6.19.6"],"patched":["linux_kernel 6.19.6"],"published":"2026-05-06","updated":"2026-10-14","sourceUpdated":"2026-10-14T13:10:00.187","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-71295","references":[{"url":"https://git.kernel.org/stable/c/1b111a69a6e33a922622bf9870e4e63fb2b649c8","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/42c32d7571ccd8ef32351cac506f00b0fae99fd2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/727e5140e0cf83b4ce6a11b89bb73bff5d96f8f3","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b68f91ef3b3fe82ad78c417de71b675699a8467c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c1b6227555c52781178132b7a06466711855795c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/c6246ca15999053d2632fbcc7b86e6eef7f077cb","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd"],"epss":0.00123,"epssPercentile":0.0183,"ingestedAt":"2026-10-14T13:30:58.488Z","slug":"CVE-2025-71295","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfs/buffer: add alert in try_to_free_buffers() for folios without buffers\n\ntry_to_free_buffers() can be called on folios with no buffers attached\nwhen filemap_release_folio() is invoked on a folio belonging to a mapping\nwith AS_RELEASE_ALWAYS set but no release_folio operation defined.\n\nIn such cases, folio_needs_release() returns true because of the\nAS_RELEASE_ALWAYS flag, but the folio has no private buffer data. This\ncauses try_to_free_buffers() to call drop_buffers() on a folio with no\nbuffers, leading to a null pointer dereference.\n\nAdding a check in try_to_free_buffers() to return early if the folio has no\nbuffers attached, with WARN_ON_ONCE() to alert about the misconfiguration.\nThis provides defensive hardening.\n\n## Affected\n\n- `linux_kernel >= 6.1.72, < 6.1.165`\n- `linux_kernel >= 6.2, < 6.6.128`\n- `linux_kernel >= 6.7, < 6.12.75`\n- `linux_kernel >= 6.13, < 6.18.16`\n- `linux_kernel >= 6.19, < 6.19.6`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.19.6`","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}