{"cve":"CVE-2025-71184","nvd":{"published":"2026-01-31T12:16:03.673","modified":"2026-10-30T13:18:26.450","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: fix NULL dereference on root when tracing inode eviction\n\nWhen evicting an inode the first thing we do is to setup tracing for it,\nwhich implies fetching the root's id. But in btrfs_evict_inode() the\nroot might be NULL, as implied in the next check that we do in\nbtrfs_evict_inode().\n\nHence, we either should set the ->root_objectid to 0 in case the root is\nNULL, or we move tracing setup after checking that the root is not\nNULL. Setting the rootid to 0 at least gives us the possibility to trace\nthis call even in the case when the root is NULL, so that's the solution\ntaken here.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":["CWE-476"],"references":["https://git.kernel.org/stable/c/582ba48e4a4c06fef6bdcf4e57b7b9af660bbd0c","https://git.kernel.org/stable/c/64d8abd8c5305795a2b35fc96039d99d34f5e762","https://git.kernel.org/stable/c/99181ddb124cfe2b09f5e924c308222d2339e82a","https://git.kernel.org/stable/c/99e057f3d3ef24b99a7b1d84e01dd1bd890098da","https://git.kernel.org/stable/c/f157dd661339fc6f5f2b574fe2429c43bd309534"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-30T13:47:47.119061695+00:00"},"epss":{"cve":"CVE-2025-71184","score":0.00141,"percentile":0.03432,"date":"2026-10-30"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}