High 7.5Published May 6, 2026

CVE-2025-71292jfs: nlink overflow in jfs_rename

Updated under an hour ago (Oct 26, 2026, 7:50 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: jfs: nlink overflow in jfs_rename If nlink is maximal for a directory (-1) and inside that directory you perform a rename for some child directory (not moving from the parent), then the nlink of the first directory is first incremented and later decremented. Normally this is fine, but when nlink = -1 this causes a wrap around to 0, and then drop_nlink issues a warning. After applying the patch syzbot no longer issues any warnings. I also ran some basic fs tests to look for any regressions.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 2108829a59f081e822fdab8c2cd7131deb8aa8a1; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before b4330a0d0947fbdc9d445cbbeabd8cc910a8c9ca; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before a3d66089e50a6e0142f8884471f74292102ea9aa; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before f70fcbc2ac7c24f087a2c895c5753aa730b1e479; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 5d77c36cd4b698649f5c30c5f6c084f4f61d1880; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before fe136426e30ca6debcf916fd6a141555ed9fde74; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 93c325746ae59709b4f9bad4e3e4761c8d566c70; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 9218dc26fd922b09858ecd3666ed57dfd8098da8	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.12.1 before 5.10.252; from 5.11 before 5.15.202; from 5.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.16; from 6.19 before 6.19.6; 2.6.12; and 5 more ranges	NVD

References

References

https://git.kernel.org/stable/c/2108829a59f081e822fdab8c2cd7131deb8aa8a1	patch
https://git.kernel.org/stable/c/b4330a0d0947fbdc9d445cbbeabd8cc910a8c9ca	patch
https://git.kernel.org/stable/c/a3d66089e50a6e0142f8884471f74292102ea9aa	patch
https://git.kernel.org/stable/c/f70fcbc2ac7c24f087a2c895c5753aa730b1e479	patch
https://git.kernel.org/stable/c/5d77c36cd4b698649f5c30c5f6c084f4f61d1880	patch
https://git.kernel.org/stable/c/fe136426e30ca6debcf916fd6a141555ed9fde74	patch
https://git.kernel.org/stable/c/93c325746ae59709b4f9bad4e3e4761c8d566c70	patch
https://git.kernel.org/stable/c/9218dc26fd922b09858ecd3666ed57dfd8098da8	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.