shmem: fix recovery on rename failures
CVE-2025-71072 · published 13 Jan 2026
How serious is it
- Severity: high, CVSS score 8.2 out of 10.
- No exploit prediction (EPSS) score yet.
- Not on the CISA list of exploited vulnerabilities.
- No public exploit in Exploit-DB.
Is your app affected by CVE-2025-71072?
Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.
Who is affected
- Linux Linux: a2e459555c5f9da3e619b7e47a63f98574dc75f1 to < 8fdbc6f9a994eb327868a4aa74a58953f31a2d0f, a2e459555c5f9da3e619b7e47a63f98574dc75f1 to < 4b0fe71fb3965d0db83cdfc2f4fe0b3227d70113, a2e459555c5f9da3e619b7e47a63f98574dc75f1 to < 4642686699a46718d7f2fb5acd1e9d866a9d9cca, a2e459555c5f9da3e619b7e47a63f98574dc75f1 to < e1b4c6a58304fd490124cc2b454d80edc786665c
- Linux Linux: 6.6
How to check
- Find out whether you run the affected product and which version, then compare it with the versions above.
How to fix
Copies a prompt for Claude Code, Cursor or Codex that asks it to check whether you run this product.
- Apply the vendor's update or mitigation from the references below. If there is none yet, limit exposure of the affected service until there is.
- If a vulnerable version was live, check your logs and rotate the secrets that server could read.
The advisory
In the Linux kernel, the following vulnerability has been resolved:
shmem: fix recovery on rename failures
maple_tree insertions can fail if we are seriously short on memory;
simple_offset_rename() does not recover well if it runs into that.
The same goes for simple_offset_rename_exchange().
Moreover, shmem_whiteout() expects that if it succeeds, the caller will
progress to d_move(), i.e. that shmem_rename2() won't fail past the
successful call of shmem_whiteout().
Not hard to fix, fortunately - mtree_store() can't fail if the index we
are trying to store into is already present in the tree as a singleton.
For simple_offset_rename_exchange() that's enough - we just need to be
careful about the order of operations.
For simple_offset_rename() solution is to preinsert the target into the
tree for new_dir; the rest can be done without any potentially failing
operations.
That preinsertion has to be done in shmem_rename2() rather than in
simple_offset_rename() itself - otherwise we'd need to deal with the
possibility of failure after successful shmem_whiteout().
Check your whole app
Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.
References
- git.kernel.org/stable/c/8fdbc6f9a994eb327868a4aa74a58953f31a2d0f
- git.kernel.org/stable/c/4b0fe71fb3965d0db83cdfc2f4fe0b3227d70113
- git.kernel.org/stable/c/4642686699a46718d7f2fb5acd1e9d866a9d9cca
- git.kernel.org/stable/c/e1b4c6a58304fd490124cc2b454d80edc786665c
Merged from CVE List. Last updated 25 Oct 2026. All vulnerabilities · RSS · JSON