CVE-2025-71105— f2fs: use global inline_xattr_slab instead of per-sb slab cache
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于使用全局inline_xattr_slab而非每个超级块的slab缓存，可能导致重复创建缓存。
Possible ATT&CK Techniques 3 AI
T1068 · Exploitation for Privilege Escalation T1611 · Escape to Host T1203 · Exploitation for Client ExecutionAffected Version Matrix 16
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | a999150f4fe3abbb7efd05411fd5b460be699943< 93d30fe19660dec6bf1bd3d5c186c1c737b21aa5 |
affected |
a999150f4fe3abbb7efd05411fd5b460be699943< 474cc3ed37436ddfd63cac8dbffe3b1e219e9100 |
affected | ||
a999150f4fe3abbb7efd05411fd5b460be699943< 72ce19dfed162da6e430467333b2da70471d08a4 |
affected | ||
a999150f4fe3abbb7efd05411fd5b460be699943< be4c3a3c6c2304a8fcd14095d18d26f0cc4e222a |
affected | ||
a999150f4fe3abbb7efd05411fd5b460be699943< 1eb0b130196bcbc56c5c80c83139fa70c0aa82c5 |
affected | ||
a999150f4fe3abbb7efd05411fd5b460be699943< e6d828eae00ec192e18c2ddaa2fd32050a96048a |
affected | ||
a999150f4fe3abbb7efd05411fd5b460be699943< 1f27ef42bb0b7c0740c5616ec577ec188b8a1d05 |
affected | ||
5.7 |
affected | ||
| … +8 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-71105
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
f2fs: use global inline_xattr_slab instead of per-sb slab cache
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
f2fs: use global inline_xattr_slab instead of per-sb slab cache
As Hong Yun reported in mailing list:
loop7: detected capacity change from 0 to 131072
------------[ cut here ]------------
kmem_cache of name 'f2fs_xattr_entry-7:7' already exists
WARNING: CPU: 0 PID: 24426 at mm/slab_common.c:110 kmem_cache_sanity_check mm/slab_common.c:109 [inline]
WARNING: CPU: 0 PID: 24426 at mm/slab_common.c:110 __kmem_cache_create_args+0xa6/0x320 mm/slab_common.c:307
CPU: 0 UID: 0 PID: 24426 Comm: syz.7.1370 Not tainted 6.17.0-rc4 #1 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
RIP: 0010:kmem_cache_sanity_check mm/slab_common.c:109 [inline]
RIP: 0010:__kmem_cache_create_args+0xa6/0x320 mm/slab_common.c:307
Call Trace:
__kmem_cache_create include/linux/slab.h:353 [inline]
f2fs_kmem_cache_create fs/f2fs/f2fs.h:2943 [inline]
f2fs_init_xattr_caches+0xa5/0xe0 fs/f2fs/xattr.c:843
f2fs_fill_super+0x1645/0x2620 fs/f2fs/super.c:4918
get_tree_bdev_flags+0x1fb/0x260 fs/super.c:1692
vfs_get_tree+0x43/0x140 fs/super.c:1815
do_new_mount+0x201/0x550 fs/namespace.c:3808
do_mount fs/namespace.c:4136 [inline]
__do_sys_mount fs/namespace.c:4347 [inline]
__se_sys_mount+0x298/0x2f0 fs/namespace.c:4324
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x8e/0x3a0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x76/0x7e
The bug can be reproduced w/ below scripts:
- mount /dev/vdb /mnt1
- mount /dev/vdc /mnt2
- umount /mnt1
- mounnt /dev/vdb /mnt1
The reason is if we created two slab caches, named f2fs_xattr_entry-7:3
and f2fs_xattr_entry-7:7, and they have the same slab size. Actually,
slab system will only create one slab cache core structure which has
slab name of "f2fs_xattr_entry-7:3", and two slab caches share the same
structure and cache address.
So, if we destroy f2fs_xattr_entry-7:3 cache w/ cache address, it will
decrease reference count of slab cache, rather than release slab cache
entirely, since there is one more user has referenced the cache.
Then, if we try to create slab cache w/ name "f2fs_xattr_entry-7:3" again,
slab system will find that there is existed cache which has the same name
and trigger the warning.
Let's changes to use global inline_xattr_slab instead of per-sb slab cache
for fixing.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于使用全局inline_xattr_slab而非每个超级块的slab缓存，可能导致重复创建缓存。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-71105
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-71105
请登录查看更多情报信息。
Same Patch Batch · Linux · 2026-01-14 · 43 CVEs total
| CVE-2025-71116 | 9.1 CRITICAL | libceph: make decode_pool() more resilient against corrupted osdmaps |
| CVE-2025-71112 | 8.8 HIGH | net: hns3: add VLAN id validation before using |
| CVE-2025-71130 | 7.8 HIGH | drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer |
| CVE-2025-71120 | 7.5 HIGH | SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf |
| CVE-2025-71126 | 7.5 HIGH | mptcp: avoid deadlock on fallback while reinjecting |
| CVE-2025-71128 | 7.5 HIGH | erspan: Initialize options_len before referencing options. |
| CVE-2025-71131 | 7.5 HIGH | crypto: seqiv - Do not use req->iv after crypto_aead_encrypt |
| CVE-2025-71132 | 7.5 HIGH | smc91x: fix broken irq-context in PREEMPT_RT |
| CVE-2025-71127 | 7.1 HIGH | wifi: mac80211: Discard Beacon frames to non-broadcast address |
| CVE-2025-71136 | 7.1 HIGH | media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() |
| CVE-2025-71109 | 7.1 HIGH | MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits |
| CVE-2025-71108 | usb: typec: ucsi: Handle incorrect num_connectors capability | |
| CVE-2025-71111 | hwmon: (w83791d) Convert macros to functions to avoid TOCTOU | |
| CVE-2025-71104 | KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer | |
| CVE-2025-71115 | um: init cpu_tasks[] earlier | |
| CVE-2025-71103 | drm/msm: adreno: fix deferencing ifpc_reglist when not declared | |
| CVE-2025-71117 | block: Remove queue freezing from several sysfs store callbacks | |
| CVE-2025-71118 | ACPICA: Avoid walking the Namespace if start_node is NULL | |
| CVE-2025-71102 | scs: fix a wrong parameter in __scs_magic | |
| CVE-2025-71106 | fs: PM: Fix reverse check in filesystems_freeze_callback() |
Showing top 20 of 43 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U -
CVE-2026-98865
sched_ext: Don't run ops.dequeue() with a DSQ lock held -
CVE-2026-98864
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing
Same vendor: Linux
-
CVE-2026-98868
dm-pcache: reject a kset that overruns its segment -
CVE-2026-98867
dm-pcache: bound the logical key offset from persistent memo -
CVE-2026-98866
sched/cache: Introduce task_struct->sched_cache_grp to fix U -
CVE-2026-98865
sched_ext: Don't run ops.dequeue() with a DSQ lock held -
CVE-2026-98864
sched_ext: Wait for SCX_OPSS_DISPATCHING before reenqueueing
V. Comments for CVE-2025-71105
Anonymous User
2026-01-15 06:08:19Zaproxy alias impedit expedita quisquam pariatur exercitationem. Nemo rerum eveniet dolores rem quia dignissimos.