---
id: CVE-2025-71184
title: 'btrfs: fix NULL dereference on root when tracing inode eviction'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  btrfs: fix NULL dereference on root when tracing inode eviction

  When evicting an inode the first thing we do is to setup tracing for it,
  which implies fetching the roo…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1abe9b8a138c9988ba8f7bfded6453649a31541f <
    99181ddb124cfe2b09f5e924c308222d2339e82a
  - >-
    Linux >= 1abe9b8a138c9988ba8f7bfded6453649a31541f <
    64d8abd8c5305795a2b35fc96039d99d34f5e762
  - >-
    Linux >= 1abe9b8a138c9988ba8f7bfded6453649a31541f <
    582ba48e4a4c06fef6bdcf4e57b7b9af660bbd0c
  - >-
    Linux >= 1abe9b8a138c9988ba8f7bfded6453649a31541f <
    99e057f3d3ef24b99a7b1d84e01dd1bd890098da
  - >-
    Linux >= 1abe9b8a138c9988ba8f7bfded6453649a31541f <
    f157dd661339fc6f5f2b574fe2429c43bd309534
  - Linux 2.6.39
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:14:59.801669Z'
published: '2026-01-31'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:23:10.153Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-71184'
references:
  - url: 'https://git.kernel.org/stable/c/99181ddb124cfe2b09f5e924c308222d2339e82a'
  - url: 'https://git.kernel.org/stable/c/64d8abd8c5305795a2b35fc96039d99d34f5e762'
  - url: 'https://git.kernel.org/stable/c/582ba48e4a4c06fef6bdcf4e57b7b9af660bbd0c'
  - url: 'https://git.kernel.org/stable/c/99e057f3d3ef24b99a7b1d84e01dd1bd890098da'
  - url: 'https://git.kernel.org/stable/c/f157dd661339fc6f5f2b574fe2429c43bd309534'
tags:
  - cve.org
epss: 0.00141
epssPercentile: 0.03477
ingestedAt: '2026-11-05T15:02:32.177Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix NULL dereference on root when tracing inode eviction

When evicting an inode the first thing we do is to setup tracing for it,
which implies fetching the root's id. But in btrfs_evict_inode() the
root might be NULL, as implied in the next check that we do in
btrfs_evict_inode().

Hence, we either should set the ->root_objectid to 0 in case the root is
NULL, or we move tracing setup after checking that the root is not
NULL. Setting the rootid to 0 at least gives us the possibility to trace
this call even in the case when the root is NULL, so that's the solution
taken here.

## Affected

- `Linux >= 1abe9b8a138c9988ba8f7bfded6453649a31541f < 99181ddb124cfe2b09f5e924c308222d2339e82a`
- `Linux >= 1abe9b8a138c9988ba8f7bfded6453649a31541f < 64d8abd8c5305795a2b35fc96039d99d34f5e762`
- `Linux >= 1abe9b8a138c9988ba8f7bfded6453649a31541f < 582ba48e4a4c06fef6bdcf4e57b7b9af660bbd0c`
- `Linux >= 1abe9b8a138c9988ba8f7bfded6453649a31541f < 99e057f3d3ef24b99a7b1d84e01dd1bd890098da`
- `Linux >= 1abe9b8a138c9988ba8f7bfded6453649a31541f < f157dd661339fc6f5f2b574fe2429c43bd309534`
- `Linux 2.6.39`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.