CVE-2025-71184: btrfs: fix NULL dereference on root when tracing inode eviction
In the Linux kernel, the following vulnerability has been resolved:
btrfs: fix NULL dereference on root when tracing inode eviction
When evicting an inode the first thing we do is to setup tracing for it,
which implies fetching the root's id. But in btrfs_evict_inode() the
root might be NULL, as implied in the next check that we do in
btrfs_evict_inode().
Hence, we either should set the ->root_objectid to 0 in case the root is
NULL, or we move tracing setup after checking that the root is not
NULL. Setting the rootid to 0 at least gives us the possibility to trace
this call even in the case when the root is NULL, so that's the solution
taken here.
Security readout for executives and security teams
Plain-English summary
This is a Linux kernel btrfs bug that can hit a NULL pointer while evicting an inode and setting up tracing. In practical terms, affected systems using btrfs could experience kernel instability. The source bundle does not provide CVSS, impact scope, or attacker requirements.
Executive priority
Patch through normal kernel maintenance. Raise priority for production systems that use btrfs or have observed kernel instability. Current source evidence does not support emergency exploitation response.
Technical view
btrfs_evict_inode() may access the root object before confirming the inode root is non-NULL. The fix records root_objectid as 0 when root is NULL, preserving tracing without dereferencing a NULL root. References are Linux stable kernel commits.
Likely exposure
Exposure is most relevant to Linux systems using btrfs on kernel versions identified as affected by the CVE record. Distro backports may change practical status, so package-level vendor advisories are needed.
Exploitation context
The bundle does not cite active exploitation, KEV listing, exploit availability, privilege requirements, or remote reachability. Treat this as a kernel reliability/security fix until vendor advisories provide more context.
Researcher notes
Key uncertainty is exploitability. The record describes a NULL dereference during inode eviction tracing but does not define attacker control, crash reliability, or security boundary impact. Validate against upstream stable commits and downstream distro patches.
Mitigation direction
Apply Linux kernel updates that include the referenced stable btrfs fixes.
Check distribution advisories for the exact fixed kernel package.
Prioritize systems actively using btrfs filesystems.
Reboot into the updated kernel after patching.
If patching is delayed, monitor vendor guidance for temporary mitigations.
Validation and detection
Inventory hosts running Linux with btrfs filesystems mounted.
Compare running kernel packages against distribution fixed versions.
Confirm the booted kernel includes the referenced stable commit lineage.
Review kernel logs for btrfs NULL dereference or oops events.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2025-71184 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
0CVSS vectors
3Timeline events
0ADP providers
5Source links
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
CVE publishedCVE Program
The CVE record was published.
Jan 31, 2026, 11:38 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.