CVE-2025-71239: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71239 is a Linux kernel audit bypass vulnerability caused by the omission of the fchmodat2() system call from the kernel audit subsystem's change attributes class. Introduced in kernel version 6.6, fchmodat2() was never registered with the audit framework, allowing file permission changes made via this syscall to silently bypass audit watch rules (e.g., -w /tmp/test -p rwa -k test_rwa). Affected kernel versions include 6.6.x before 6.6.128, 6.7–6.12.x before 6.12.75, 6.13–6.18.x before 6.18.16, and 6.19.x before 6.19.6. It was published on March 17, 2026, with a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Microsoft MSRC).

The root cause is an incomplete syscall registration in the Linux kernel audit subsystem (CWE-284: Improper Access Control / audit omission). When fchmodat2() was introduced in kernel 6.6 as a variant of fchmodat() supporting additional flags, it was not added to the audit change_attr syscall class that governs monitoring of file attribute modifications. As a result, a local user with standard privileges can invoke fchmodat2() to change file permissions in the same manner as chmod() or fchmodat(), but the action will not be captured by any configured audit rules. The fix registers fchmodat2() in the audit change attributes class alongside chmod(), fchmod(), fchmodat(), and related calls (Feedly, ENISA EUVD).

Successful exploitation allows a local, low-privileged user to modify file attributes and permissions on the system without generating any audit log entries, effectively creating a blind spot in security monitoring. Organizations relying on kernel audit rules to detect unauthorized file permission changes — a common compliance and intrusion detection control — will have an undetected gap for any activity using fchmodat2(). This does not directly enable privilege escalation or data exfiltration, but it undermines the integrity of the audit trail, which can facilitate post-exploitation cover-up or compliance violations (Feedly).

1. Gain local access: Obtain a low-privileged shell on a Linux system running kernel version 6.6 through 6.19.5 (or equivalent stable branch before the fix).
2. Identify audit rules: Review active audit rules using auditctl -l to confirm file-watch rules are in place (e.g., -w /tmp/test -p rwa -k test_rwa).
3. Invoke fchmodat2() instead of chmod(): Write or use a program that calls the fchmodat2() syscall (syscall number 452 on x86_64) to modify file permissions on a monitored file, rather than using chmod() or fchmodat().
4. Verify audit bypass: Check the audit log (ausearch -k test_rwa or /var/log/audit/audit.log) to confirm no event was recorded for the permission change, demonstrating the audit rule was bypassed.
5. Leverage for cover-up: Use fchmodat2() during post-exploitation activity to alter file permissions (e.g., making sensitive files world-readable or modifying SUID bits) without triggering audit alerts (Feedly, ENISA EUVD).

• Logs: Absence of expected audit log entries for file permission changes on monitored paths when fchmodat2() (syscall 452 on x86_64) is used; gaps in audit.log for known-sensitive directories under active watch rules.
• Process/Syscall: Processes invoking syscall number 452 (fchmodat2) on security-sensitive files or directories — detectable via strace, eBPF-based monitoring tools (e.g., Falco, Tetragon), or auditctl rules explicitly added for fchmodat2 as a workaround.
• File System: Unexpected permission changes on monitored files (e.g., SUID/SGID bits set, world-writable permissions) that do not correspond to any audit log event.

Update the Linux kernel to a patched version that includes fchmodat2() in the audit change attributes class. Fixed versions are: 6.6.128, 6.12.75, 6.18.16, 6.19.6, 5.10.252, 5.15.202, 6.1.165, and 7.0-rc1 or later (Feedly, ENISA EUVD). Distribution-specific updates are available for Red Hat, SUSE, Debian, Amazon Linux 2023, and openSUSE. As a temporary workaround prior to patching, administrators can add explicit audit rules targeting the fchmodat2 syscall directly using auditctl -a always,exit -F arch=b64 -S fchmodat2 -k file_attr_changes to close the monitoring gap.

Red Hat published a security advisory tracking this CVE, and Microsoft acknowledged it via the MSRC update guide in the context of Azure Linux (AZL3) kernel packages (Microsoft MSRC, Red Hat). The vulnerability was also covered by a technical blog post at bencteux.fr discussing missing syscalls in the Linux audit framework, which likely contributed to the discovery and disclosure (ENISA EUVD). Downstream distributions including SUSE, Debian, Amazon Linux 2023, and openSUSE have issued security advisories and kernel updates addressing this issue.