PT-2026-8125 · Linux · Linux Kernel

Published 2025-01-01 · Updated 2026-02-14 · CVE-2025-71201

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw in the netfs component related to the handling of read requests and folio unlocking. Specifically, the issue arises when collecting read results for buffered reads, potentially leading to an early unlock of a page containing the end of file (EOF). This can occur when the collected file position is ahead of the completion of subrequests. The problem stems from unlocking a folio at the EOF position before a subsequent 'ZERO' subrequest has completed, potentially exposing uncleared tail data to applications using mmap. The issue is most reliably reproducible with 9P, due to its synchronous READ operation, but can also occur in other file systems under certain conditions. A test case involves creating a file not aligned to a page boundary and performing mmap, madvise, and mread operations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2025-71201

RHSA-2025:20095

Affected Products

Linux Kernel

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71201.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-71201 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-71201 · Vendor Advisory
• https://git.kernel.org/stable/c/5b5482c0e5ee740b35a70759d3582477aea8e8e4 · Patch
• https://git.kernel.org/stable/c/570ad253a3455a520f03c2136af8714bc780186d · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-71201 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-71201 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-71201 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-71201 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-71201 · Vendor Advisory
• https://git.kernel.org/linus/570ad253a3455a520f03c2136af8714bc780186d · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://twitter.com/CVEnew/status/2022702085779890519 · Twitter Post
• https://t.me/cveNotify/152039 · Telegram Post