CVE-2025-71072: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71072 is a denial-of-service vulnerability in the Linux kernel's shared memory (shmem) subsystem, specifically in the rename operation error-recovery path. The flaw was published on January 13, 2026, and affects Linux kernel versions 6.6.1 through 6.12.63, 6.13 through 6.18.2, and discrete versions 6.6 and 6.19-rc1 through 6.19-rc8. It carries a CVSS v3.1 base score of 5.5 (Medium), reflecting a local, low-privilege attack vector with high availability impact and no confidentiality or integrity impact (Feedly, NVD).

The root cause is inadequate error recovery in the shmem subsystem's simple_offset_rename() and simple_offset_rename_exchange() functions when maple_tree insertions fail under severe memory pressure (classified as NVD-CWE-noinfo due to insufficient public detail, but functionally related to improper error handling). When a maple_tree insertion fails, simple_offset_rename() does not properly roll back state, and shmem_whiteout() incorrectly assumes that a successful call will always be followed by d_move() — an assumption violated when shmem_rename2() fails after shmem_whiteout() succeeds. The fix leverages the fact that mtree_store() cannot fail if the target index is already present as a singleton, allowing pre-insertion of the rename target in shmem_rename2() before any potentially failing operations occur (Feedly, NVD).

A local attacker with low privileges can trigger this vulnerability by initiating file rename operations on a tmpfs/shmem filesystem under conditions of severe memory pressure, potentially causing system instability, kernel panics, or persistent unavailability of system resources. The impact is limited to availability — there is no confidentiality or integrity exposure. Systems relying heavily on shared memory or tmpfs (e.g., container runtimes, in-memory databases) may be disproportionately affected (Feedly).

The vulnerability has been patched in Linux kernel versions 6.12.64, 6.18.3, and 6.19-rc2. Patches are available at the official kernel stable repository. Administrators should update affected systems to one of these fixed versions as soon as possible. No configuration-based workaround is known; upgrading the kernel is the only remediation. Systems running kernel versions 6.6.1–6.12.63 or 6.13–6.18.2 should be prioritized for patching, particularly those running container workloads or applications that make heavy use of tmpfs (Feedly, kernel.org patch 1, kernel.org patch 2, kernel.org patch 3).

Ubuntu issued multiple security notices addressing this vulnerability, including USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, and USN-8257-1. The Yocto Project security mailing list also tracked the issue across several messages. No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability (Ubuntu USN-8177-1, Ubuntu USN-8183-1).