shmem: fix recovery on rename failures
In the Linux kernel, the following vulnerability has been resolved: shmem: fix recovery on rename failures maple_tree insertions can fail if we are seriously short on memory; simple_offset_rename() does not recover well if it runs into that. The same goes for simple_offset_rename_exchange(). Moreover, shmem_whiteout() expects that if it succeeds, the caller will progress to d_move(), i.e. that shmem_rename2() won't fail past the successful call of shmem_whiteout(). Not hard to fix, fortunately - mtree_store() can't fail if the index we are trying to store into is already present in the tree as a singleton. For simple_offset_rename_exchange() that's enough - we just need to be careful about the order of operations. For simple_offset_rename() solution is to preinsert the target into the tree for new_dir; the rest can be done without any potentially failing operations. That preinsertion has to be done in shmem_rename2() rather than in simple_offset_rename() itself - otherwise we'd need to deal with the possibility of failure after successful shmem_whiteout().
CVE-2025-71072
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-71072
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "a2e459555c5f9da3e619b7e47a63f98574dc75f1",
"lessThan": "8fdbc6f9a994eb327868a4aa74a58953f31a2d0f",
"versionType": "git"
},
{
"status": "affected",
"version": "a2e459555c5f9da3e619b7e47a63f98574dc75f1",
"lessThan": "4b0fe71fb3965d0db83cdfc2f4fe0b3227d70113",
"versionType": "git"
},
{
"status": "affected",
"version": "a2e459555c5f9da3e619b7e47a63f98574dc75f1",
"lessThan": "4642686699a46718d7f2fb5acd1e9d866a9d9cca",
"versionType": "git"
},
{
"status": "affected",
"version": "a2e459555c5f9da3e619b7e47a63f98574dc75f1",
"lessThan": "e1b4c6a58304fd490124cc2b454d80edc786665c",
"versionType": "git"
}
],
"programFiles": [
"fs/libfs.c",
"include/linux/fs.h",
"mm/shmem.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.6"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.6",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.64",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.3",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/libfs.c",
"include/linux/fs.h",
"mm/shmem.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2025-71072
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #46079 · Revision 1
- Added to Heist Feed
- Publisher date