CVE-2025-71184: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71184 is a NULL pointer dereference vulnerability in the Linux kernel's btrfs filesystem subsystem, specifically within the btrfs_evict_inode() function. During inode eviction, the kernel attempts to set up tracing by fetching the root's ID before verifying that the root pointer is non-NULL, leading to a potential kernel crash. The vulnerability affects Linux kernel versions from 2.6.39 through 6.6.129, 6.7 through 6.12.65, and 6.13 through 6.18.5. It was published on January 31, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-476 (NULL Pointer Dereference). In btrfs_evict_inode(), tracing setup is performed as the very first operation, which involves dereferencing the inode's root pointer to retrieve its object ID. However, the root pointer can legitimately be NULL at this stage — a condition that is checked later in the same function but not before the tracing call. The fix sets root_objectid to 0 when the root is NULL, allowing tracing to proceed safely without dereferencing a NULL pointer (Red Hat Bugzilla, Red Hat Advisory). The attack vector is local, requires low privileges, and no user interaction (Red Hat Advisory).

Successful exploitation allows a local attacker with low privileges to trigger a kernel panic or denial of service by forcing inode eviction on a btrfs filesystem when the root pointer is NULL. The impact is limited to availability — there is no confidentiality or integrity impact. The vulnerability does not enable code execution or lateral movement, but a kernel crash would render the affected system completely unavailable until rebooted (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Red Hat Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. No threat actor attribution has been identified.

Apply the upstream kernel patches that fix this issue. The fix has been merged into the following stable kernel versions: 6.6.130, 6.12.66, and 6.18.6 (and later), as well as the 6.19-rc5 development branch (Red Hat Advisory). Patch commits are available at the kernel stable tree: 582ba48e, 99e057f3, f157dd66, and 64d8abd8. As a temporary workaround, restrict local user access to systems running btrfs filesystems until the patch can be applied. Distribution-specific updates are available from Red Hat, SUSE, Ubuntu, and Oracle Linux.