CVE-2025-71183 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux systems that use the btrfs filesystem should assess their exposure and apply patches as necessary. Linux kernel developers and testers should review the patches and update their systems accordingly. Linux distribution maintainers should ensure that the updated kernel is included in their distributions. Users of Linux systems that use the btrfs filesystem should also

Why it matters

This vulnerability in the Linux kernel's btrfs module could allow an attacker to delete an inode that should not be deleted after a power failure, potentially resulting in data loss or corruption. Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux systems that use the btrfs filesystem should assess their exposure and apply patches as necessary.

• Data loss or corruption due to incorrect inode deletion
• Potential system crashes or instability
• Increased risk of data loss or corruption if not properly patched

Technical summary

The vulnerability is caused by the btrfs module's incorrect handling of inode references during logging. When two inodes are exchanged, and at least one of them is a directory, the log tree may contain only one of the inodes. After a power failure, this can lead to an attempt to delete the other inode, potentially resulting in data loss or corruption. The issue is related to the btrfs module's handling of inode references during logging, particularly when two inodes are exchanged, and at least one of them is a directory. The log tree may contain only one of the inodes, leading to an attempt to delete the other inode. This delete attempt may fail if the target inode is a directory containing a subvolume.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Ensure that the Linux kernel is updated to a version that includes the fix
• Monitor the Linux kernel's btrfs module for potential issues
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is related to the btrfs module's handling of inode references during logging. The issue arises when two inodes are exchanged, and at least one of them is a directory. After a power failure, the log tree may contain only one of the inodes, leading to an attempt to delete the other inode. This delete attempt may fail if the target inode is a directory containing a subvolume.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.