{
  "threat_severity" : "Low",
  "public_date" : "2026-01-13T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: shmem: fix recovery on rename failures",
    "id" : "2429083",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2429083"
  },
  "cvss3" : {
    "cvss3_base_score" : "2.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L",
    "status" : "verified"
  },
  "cwe" : "CWE-390",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nshmem: fix recovery on rename failures\nmaple_tree insertions can fail if we are seriously short on memory;\nsimple_offset_rename() does not recover well if it runs into that.\nThe same goes for simple_offset_rename_exchange().\nMoreover, shmem_whiteout() expects that if it succeeds, the caller will\nprogress to d_move(), i.e. that shmem_rename2() won't fail past the\nsuccessful call of shmem_whiteout().\nNot hard to fix, fortunately - mtree_store() can't fail if the index we\nare trying to store into is already present in the tree as a singleton.\nFor simple_offset_rename_exchange() that's enough - we just need to be\ncareful about the order of operations.\nFor simple_offset_rename() solution is to preinsert the target into the\ntree for new_dir; the rest can be done without any potentially failing\noperations.\nThat preinsertion has to be done in shmem_rename2() rather than in\nsimple_offset_rename() itself - otherwise we'd need to deal with the\npossibility of failure after successful shmem_whiteout().", "A flaw was found in the Linux kernel's shmem (tmpfs) filesystem rename operation. Under severe memory pressure, the maple_tree insertion used during file rename can fail, and the error recovery path does not properly handle this failure. This can leave the filesystem directory offset tree in an inconsistent state." ],
  "statement" : "Triggering this vulnerability requires extreme memory exhaustion conditions during tmpfs rename operations. Normal system operation with adequate memory is unaffected. The filesystem inconsistency could cause subsequent directory operations to fail unexpectedly.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-08-11T00:00:00Z",
    "advisory" : "RHSA-2026:53330",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "kernel-0:6.12.0-211.46.1.el10_2"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2025-71072\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-71072\nhttps://lore.kernel.org/linux-cve-announce/2026011325-CVE-2025-71072-b52b@gregkh/T" ],
  "name" : "CVE-2025-71072",
  "csaw" : false
}