CVE-2025-71159: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71159 is a use-after-free (UAF) vulnerability in the Linux kernel's btrfs filesystem subsystem, specifically within the btrfs_get_or_create_delayed_node() function. It was introduced by commit e8513c012de7 ("btrfs: implement ref_tracker for delayed_nodes"), which moved refcount_set inside a critical section, eliminating a necessary memory barrier. The vulnerability affects Linux kernel versions 6.18 through 6.18.5 and 6.19-rc1 through 6.19-rc4. It was published on January 23, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a missing memory barrier (CWE-416: Use After Free) introduced when refcount_set was moved inside the root->delayed_nodes lock's critical section. Without the implicit barrier previously provided by lock acquisition, the stores to node->refs and btrfs_inode->delayed_node can become visible to other threads out of order. A concurrent thread may read btrfs_inode->delayed_node and attempt to increment a reference count that has not yet been initialized, triggering a refcounting bug and a use-after-free condition. The fix restores refcount_set to its original position outside the critical section, leveraging the lock acquisition's implicit memory barrier, and allows allocations to use GFP_NOFS instead of GFP_ATOMIC (Red Hat Bugzilla, kernel.org patch 1, kernel.org patch 2).

A local attacker with low privileges could exploit this race condition during concurrent btrfs filesystem operations to cause a denial of service (system crash or kernel panic), data corruption, or potentially escalate privileges. The vulnerability affects confidentiality, integrity, and availability at a high level, as the use-after-free condition can lead to arbitrary kernel memory access or manipulation. The scope is limited to the local system, but the impact on btrfs-mounted filesystems could extend to data loss or unauthorized access to sensitive kernel structures (Red Hat Advisory).

Update the Linux kernel to version 6.18.6 or later, which includes the fix. The patches are available in the kernel stable repository as commits 83f59076a1ae6f5c6845d6f7ed3a1a373d883684 and c8385851a5435f4006281828d428e5d0b0bbf8af. As a temporary workaround where patching is not immediately possible, restrict local user access to systems running vulnerable kernel versions and limit the use of btrfs filesystems. Monitor systems for unexpected kernel warnings, crashes, or anomalies related to btrfs operations (kernel.org patch 1, kernel.org patch 2, Red Hat Advisory).

Red Hat has tracked this vulnerability with low severity/priority in their Bugzilla system, reflecting the limited exploitability and local-only attack vector. No notable public researcher commentary or significant media coverage has been identified beyond standard vulnerability database entries (Red Hat Bugzilla).