7.5

CVE-2025-71292: linux

CVSS: 7.5v3.1HighModified
AliasesUBUNTU-CVE-2025-71292DEBIAN-CVE-2025-71292
Published 06-05-2026Last modified 05-08-2026
Open JSON

Vulnerability summary

CVE-2025-71292 is a high (CVSS 7.5) vulnerability in linux. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 23.6% of scored vulnerabilities.

Overall risk
30/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
0.32%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 25 · Related 25
USN-8492-1USN-8492-2USN-8492-3USN-8492-4USN-8492-5USN-8497-1

Timeline

  1. 06-05-2026
    PublishedVulnerability first disclosed.
  2. 05-08-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: jfs: nlink overflow in jfs_rename If nlink is maximal for a directory (-1) and inside that directory you perform a rename for some child directory (not moving from the parent), then the nlink of the first directory is first incremented and later decremented. Normally this is fine, but when nlink = -1 this causes a wrap around to 0, and then drop_nlink issues a warning. After applying the patch syzbot no longer issues any warnings. I also ran some basic fs tests to look for any regressions.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.32%

Chance of exploitation in the next 30 days

Percentile

24%

Versus all other CVEs

30-day change

0.00 pp

From 0.32% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.32%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu157 products
  • linuxAll versions (No fix recorded) | < 5.15.0-186.196 | < 6.8.0-134.134
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1112.119 | < 6.8.0-1060.63
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 2108829a59f081e822fdab8c2cd7131deb8aa8a1 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < b4330a0d0947fbdc9d445cbbeabd8cc910a8c9ca | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < a3d66089e50a6e0142f8884471f74292102ea9aa | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < f70fcbc2ac7c24f087a2c895c5753aa730b1e479 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 5d77c36cd4b698649f5c30c5f6c084f4f61d1880 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < fe136426e30ca6debcf916fd6a141555ed9fde74 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 93c325746ae59709b4f9bad4e3e4761c8d566c70 | ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 9218dc26fd922b09858ecd3666ed57dfd8098da8 | 2.6.12
  • linux_kernel≥ 2.6.12.1, < 5.10.252 | ≥ 5.11, < 5.15.202 | ≥ 5.16, < 6.1.165 | ≥ 6.2, < 6.6.128 | ≥ 6.7, < 6.12.75 | ≥ 6.13, < 6.18.16 | ≥ 6.19, < 6.19.6 | 2.6.12 | 2.6.12:rc2 | 2.6.12:rc3 | 2.6.12:rc4 | 2.6.12:rc5 | 2.6.12:rc6
Debian1 product
  • linux< 6.1.170-1 | < 6.12.85-1 | < 6.19.6-1

3 vendors · 160 products

References

37 links
Show all 37 references