CVE-2025-71239

In the Linux kernel, the following vulnerability has been resolved:

audit: add fchmodat2() to change attributes class

fchmodat2(), introduced in version 6.6 is currently not in the change attribute class of audit. Calling fchmodat2() to change a file attribute in the same fashion than chmod() or fchmodat() will bypass audit rules such as:

-w /tmp/test -p rwa -k test_rwa

The current patch adds fchmodat2() to the change attributes class.

Audit change attribute rules did not cover fchmodat2 so chmod like attribute changes performed via fchmodat2 could bypass file watch audit rules. For the CVSS the PR:N is used in the paranoid case because unprivileged users can typically call fchmodat2 on files they own. Unlikely that actual until in the hardened environments where audit logs are used for compliance alerting and incident response.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.