CVE-2025-71292: jfs: nlink overflow in jfs_rename
In the Linux kernel, the following vulnerability has been resolved:
jfs: nlink overflow in jfsrename
If nlink is maximal for a directory (-1) and inside that directory you perform a rename for some child directory (not moving from the parent), then the nlink of the first directory is first incremented and later decremented. Normally this is fine, but when nlink = -1 this causes a wrap around to 0, and then dropnlink issues a warning.
After applying the patch syzbot no longer issues any warnings. I also ran some basic fs tests to look for any regressions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71292?
CVE-2025-71292 has a medium severity rating due to the potential for directory nlink overflow in the Linux kernel.
How do I fix CVE-2025-71292?
To fix CVE-2025-71292, update your Linux kernel to the latest version that includes the relevant patches.
What types of systems are affected by CVE-2025-71292?
CVE-2025-71292 affects systems running the JFS file system in the Linux kernel.
Can CVE-2025-71292 lead to data loss?
Yes, CVE-2025-71292 can potentially lead to data loss if the nlink count overflows.
Is CVE-2025-71292 publicly known?
Yes, CVE-2025-71292 is a publicly disclosed vulnerability in the Linux kernel.