Technical Summary

The Linux kernel vulnerability CVE-2025-71239 concerns the audit subsystem's failure to include the fchmodat2() system call, introduced in kernel version 6.6, in the change attribute class. This allowed file attribute changes made via fchmodat2() to bypass audit rules that monitor such changes, potentially evading security monitoring. The issue was fixed by updating the audit subsystem to recognize fchmodat2() as part of the change attributes class. The fix is available in Linux kernel updates distributed by Ubuntu, covering a wide range of kernel versions and architectures. The updates require a system reboot and recompilation of third-party kernel modules due to ABI changes. The vulnerability has a CVSS 3.1 score of 5.5 (medium severity), with no known exploits in the wild at the time of publication.