PT-2026-25885 · Linux · Linux Kernel

Published 2025-01-01 · Updated 2026-05-20 · CVE-2025-71239

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions 6.6 and later

Description The Linux kernel includes an issue where the fchmodat2() function, introduced in version 6.6, was not included in the audit change attributes class. Calling fchmodat2() to modify file attributes in a manner similar to chmod() or fchmodat() could bypass audit rules, such as those defined with the -w flag. The current patch resolves this by adding fchmodat2() to the change attributes class. The fchmodat2() function allows changing file attributes. The audit rules are used to track file access and modifications. Bypassing these rules could allow unauthorized changes to file permissions and ownership.

Recommendations Linux kernel version 6.6 and later: Update the kernel to include the patch that adds fchmodat2() to the change attributes class.

Exploit

Fix

Related Identifiers

CVE-2025-71239

OPENSUSE-SU-2026:20572-1

SUSE-SU-2026:21237-1

SUSE-SU-2026:21352-1

SUSE-SU-2026:21361-1

Affected Products

Linux Kernel

References · 151

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71239.json · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-71239 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-71239 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-71239 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-71239 · Security Note
• https://git.kernel.org/stable/c/3e762a03713e8c25ca0108c075d662c897fc0623 · Patch
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2204-CVE-2025-71239 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-71239 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-71239 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-71239 · Security Note
• https://git.kernel.org/stable/c/4fed776ca86378da7dd743a7b648e20b025ba8ef · Patch
• https://security-tracker.debian.org/tracker/CVE-2025-71239 · Vendor Advisory
• https://git.kernel.org/stable/c/4f493a6079b588cf1f04ce5ed6cdad45ab0d53dc · Patch
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2025-71239 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20572-1 · Vendor Advisory