CVE-2025-71069: 
CBL Mariner vulnerability analysis and mitigation

CVE-2025-71069 is a Linux kernel vulnerability in the F2FS (Flash-Friendly File System) subsystem involving stale dentry cache entries following failed RENAME_WHITEOUT operations on directories with corrupted depth values. When f2fs_add_link fails due to a corrupted directory structure, partial directory modifications are committed to disk while VFS retains stale dentry mappings pointing to freed inodes. The vulnerability was published on January 13, 2026, and affects Linux kernel versions including the Microsoft Azure Linux 3 kernel package azl3_kernel_6.6.119.3-3. It carries a CVSS v3.1 base score of 5.5 (Medium), requiring local access with low privileges (Feedly, Microsoft MSRC).

The root cause is an improper state management (CWE-459: Incomplete Cleanup) in the F2FS f2fs_rename function. F2FS can mount filesystems with corrupted directory depth values that are runtime-clamped to MAX_DIR_HASH_DEPTH. During a RENAME_WHITEOUT operation, f2fs_rename updates the target entry and deletes the source entry before attempting to add the whiteout entry via f2fs_add_link. If f2fs_add_link fails due to the corrupted directory structure, the partial modifications are already on disk, but VFS — assuming the entire operation failed — does not call d_move() to update the dentry cache. This leaves new_dentry pointing to the old inode (new_inode) whose i_nlink has already been decremented to zero; a subsequent rename targeting the same entry triggers a WARNING in drop_nlink() when VFS attempts to decrement an already-zero link count (Feedly). Patches are available in the stable kernel tree at commits 0dde30753c1e, 3d65e27e57aa, 3d95ed8cf980, and 7f2bae0c881a.

Exploitation causes a mismatch between the VFS dentry cache and the actual on-disk filesystem state, leading to system warnings, filesystem cache corruption, and potential system instability. Subsequent filesystem operations that reference the stale cached dentry may attempt to decrement i_nlink on an inode already at zero, triggering kernel WARNING messages in drop_nlink() and risking further filesystem inconsistencies. There is no confidentiality or integrity impact beyond filesystem state corruption; the primary impact is availability, as the instability can affect systems running F2FS volumes (Feedly).

Apply the available kernel patches that explicitly invalidate old_dentry and new_dentry when f2fs_add_link fails during whiteout creation, forcing VFS to refresh from disk on subsequent operations. Patches are available in the Linux stable kernel tree (commits 0dde30753c1e, 3d65e27e57aa, 3d95ed8cf980, 7f2bae0c881a) and have been incorporated into downstream distributions including Debian (linux 6.1.162-1), Ubuntu (USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, USN-8257-1), and Microsoft Azure Linux 3. As a workaround, restrict local user access to systems using F2FS filesystems and verify filesystem integrity on F2FS volumes for signs of directory corruption (Feedly, Ubuntu USN-8177-1, Debian Tracker).