{"cve":"CVE-2025-71269","nvd":{"published":"2026-03-18T18:16:22.110","modified":"2026-10-19T19:17:18.267","status":"Modified","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not free data reservation in fallback from inline due to -ENOSPC\n\nIf we fail to create an inline extent due to -ENOSPC, we will attempt to\ngo through the normal COW path, reserve an extent, create an ordered\nextent, etc. However we were always freeing the reserved qgroup data,\nwhich is wrong since we will use data. Fix this by freeing the reserved\nqgroup data in __cow_file_range_inline() only if we are not doing the\nfallback (ret is <= 0).","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":["CWE-416"],"references":["https://git.kernel.org/stable/c/0a1fbbd780f04d1b6cf48dd327c866ba937de1c4","https://git.kernel.org/stable/c/3a9fd45afadec1fbfec72057b9473d509fa8b68c","https://git.kernel.org/stable/c/3edd1f6c7c520536b62b2904807033597554dbac","https://git.kernel.org/stable/c/6de3a371a8b9fd095198b1aa68c22cc10a4c6961","https://git.kernel.org/stable/c/f8da41de0bff9eb1d774a7253da0c9f637c4470a"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-21T03:43:09.190223697+00:00"},"epss":{"cve":"CVE-2025-71269","score":0.00228,"percentile":0.1345,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}