Security readout for executives and security teams
Plain-English summary
A Linux JFS directory can mishandle an already-maximal link count during a child-directory rename, wrapping the count to zero and triggering a kernel warning. The assigned CVSS 7.5 reflects potential availability impact, but the supplied evidence demonstrates a warning rather than a confirmed outage, data loss, or code execution.
Executive priority
Treat this as a high-severity but exposure-dependent maintenance item. Promptly identify JFS usage, then patch affected critical hosts through supported kernel channels. Avoid emergency-wide action where JFS is absent. Escalate if warnings appear or vendor guidance confirms stronger availability consequences than the source bundle currently demonstrates.
Technical view
In jfs_rename, a same-parent child-directory rename temporarily increments and then decrements the parent directory's nlink. When nlink is maximal and represented as -1, the increment wraps it to zero; drop_nlink then warns. The referenced stable-kernel patches prevent the overflow. Syzbot stopped warning after the patch, and basic filesystem testing found no regressions.
Likely exposure
Exposure is limited to Linux systems using JFS with an affected kernel or a kernel lacking the referenced backport. Triggering also requires the unusual condition of a directory already having the maximal link count. The supplied version data is ambiguous, so determine exposure by vendor package guidance and fix-commit presence, not version strings alone.
Exploitation context
The supplied record is not in KEV and provides no evidence of active exploitation or a public exploit. Although the CVSS vector states network reachability and no privileges, the technical description concerns a JFS rename operation. That inconsistency should be resolved through vendor guidance before treating the flaw as remotely exploitable.
Researcher notes
The documented trigger is an edge-case metadata state: maximal directory nlink followed by a same-parent child-directory rename. Evidence establishes integer wraparound and a warning, not the full mechanism behind the CVSS availability rating. Exact affected ranges and remote exploitability remain unclear in the supplied bundle; validate against stable commits and distribution backports.
Mitigation direction
- Install a vendor kernel update containing the applicable referenced stable-kernel fix.
- Confirm the update includes the fix backport; package versions alone may be misleading.
- Prioritize JFS hosts supporting critical services or untrusted filesystem workloads.
- If updates are unavailable, obtain supported interim guidance from the Linux distribution vendor.
Validation and detection
- Inventory mounted JFS filesystems and the kernel packages running on their hosts.
- Check vendor advisories or package changelogs for the applicable referenced fix commit.
- Review kernel logs for JFS, nlink, or drop_nlink warnings.
- After updating, verify the fixed kernel is running and JFS workloads operate normally.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-71292 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6LinuxVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/2108829a59f081e822fdab8c2cd7131deb8aa8a1CVE reference, Linux
- https://git.kernel.org/stable/c/b4330a0d0947fbdc9d445cbbeabd8cc910a8c9caCVE reference, Linux
- https://git.kernel.org/stable/c/a3d66089e50a6e0142f8884471f74292102ea9aaCVE reference, Linux
- https://git.kernel.org/stable/c/f70fcbc2ac7c24f087a2c895c5753aa730b1e479CVE reference, Linux
- https://git.kernel.org/stable/c/5d77c36cd4b698649f5c30c5f6c084f4f61d1880CVE reference, Linux
- https://git.kernel.org/stable/c/fe136426e30ca6debcf916fd6a141555ed9fde74CVE reference, Linux
- https://git.kernel.org/stable/c/93c325746ae59709b4f9bad4e3e4761c8d566c70CVE reference, Linux
- https://git.kernel.org/stable/c/9218dc26fd922b09858ecd3666ed57dfd8098da8CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.