CVE-2025-71239 in Linux
Summary
by MITRE • 03/17/2026
In the Linux kernel, the following vulnerability has been resolved:
audit: add fchmodat2() to change attributes class
fchmodat2(), introduced in version 6.6 is currently not in the change attribute class of audit. Calling fchmodat2() to change a file attribute in the same fashion than chmod() or fchmodat() will bypass audit rules such as:
-w /tmp/test -p rwa -k test_rwa
The current patch adds fchmodat2() to the change attributes class.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/20/2026
The vulnerability CVE-2025-71239 represents a significant gap in the Linux kernel's audit subsystem that undermines the effectiveness of security monitoring controls. This issue specifically affects the audit framework's ability to track file attribute modifications, creating a potential bypass mechanism for attackers who wish to evade detection while performing privileged file operations. The problem manifests in the audit subsystem's classification of file permission changes, where a newly introduced system call lacks proper audit coverage despite its functional equivalence to established permission modification operations.
The technical flaw stems from the incomplete integration of the fchmodat2() system call within the kernel's audit infrastructure. Introduced in Linux kernel version 6.6, this system call provides functionality similar to chmod() and fchmodat() but with additional capabilities for changing file attributes. However, the audit subsystem's change attributes class does not include fchmodat2(), meaning that when this system call is invoked to modify file permissions or attributes, the operation remains unrecorded in audit logs. This omission creates a blind spot in security monitoring that directly contradicts the fundamental principle of comprehensive audit coverage required by security frameworks.
The operational impact of this vulnerability is substantial as it allows malicious actors to perform file attribute modifications without detection, potentially enabling them to hide their activities from security monitoring systems. When administrators implement audit rules such as -w /tmp/test -p rwa -k test_rwa to monitor specific file operations, the presence of fchmodat2() in the system creates a bypass opportunity. Attackers can leverage this system call to modify file permissions or attributes in ways that would normally trigger audit alerts, effectively evading the security controls that should monitor such activities. This vulnerability essentially creates a covert channel for privilege escalation and persistence mechanisms.
The fix implemented in the patch addresses this gap by adding fchmodat2() to the change attributes class within the audit subsystem. This modification ensures that all file attribute modifications performed through fchmodat2() are properly recorded in audit logs, maintaining the integrity of security monitoring controls. The solution aligns with the principle of least privilege and comprehensive audit coverage as mandated by security standards and best practices. From a compliance perspective, this fix ensures that organizations maintaining audit logs for security monitoring purposes can rely on complete coverage of file attribute modification operations, preventing potential security incidents from going undetected.
This vulnerability demonstrates the critical importance of maintaining comprehensive audit coverage when introducing new system calls or modifying existing functionality in operating system kernels. The issue relates to CWE-116, which addresses improper encoding or handling of security-relevant data, and aligns with ATT&CK techniques related to privilege escalation and defense evasion. Organizations implementing security monitoring solutions must ensure that their audit configurations account for all relevant system calls to maintain effective security controls. The resolution of this vulnerability reinforces the necessity of thorough testing and validation of audit subsystems when introducing new kernel functionality to prevent security monitoring gaps that could be exploited by adversaries.