CVE-2025-71161

In the Linux kernel, the following vulnerability has been resolved: dm-verity: disable recursive forward error correction There are two problems with the recursive correction: 1. It may cause denial-of-service. In fec_read_bufs, there is a loop that has 253 iterations. For each iteration, we may call verity_hash_for_block recursively. There is a limit of 4 nested recursions - that means that there may be at most 253^4 (4 billion) iterations. Red Hat QE team actually created an image that pushes dm-verity to this limit - and this image just makes the udev-worker process get stuck in the 'D' state. 2. It doesn't work. In fec_read_bufs we store data into the variable "fio->bufs", but fio bufs is shared between recursive invocations, if "verity_hash_for_block" invoked correction recursively, it would overwrite partially filled fio->bufs.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/232948cf600fba69aff36b25d85ef91a73a35756	Patch
https://git.kernel.org/stable/c/4220cb37406915c926c0e4a3dbab77cd9cceeb1e
https://git.kernel.org/stable/c/897d9006e75f46f8bd7df78faa424327ae6a4bcf
https://git.kernel.org/stable/c/d9f3e47d3fae0c101d9094bc956ed24e7a0ee801	Patch
https://git.kernel.org/stable/c/e227d2b229c7529bd98d348efc55262ccf24ab35

Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-01-23 16:15

Updated : 2026-03-25 11:16

NVD link : CVE-2025-71161

Mitre link : CVE-2025-71161

CVE.ORG link : CVE-2025-71161

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-193

Off-by-one Error

{"id": "CVE-2025-71161", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2026-01-23T16:15:53.000", "references": [{"url": "https://git.kernel.org/stable/c/232948cf600fba69aff36b25d85ef91a73a35756", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4220cb37406915c926c0e4a3dbab77cd9cceeb1e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/897d9006e75f46f8bd7df78faa424327ae6a4bcf", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d9f3e47d3fae0c101d9094bc956ed24e7a0ee801", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e227d2b229c7529bd98d348efc55262ccf24ab35", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-193"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-verity: disable recursive forward error correction\n\nThere are two problems with the recursive correction:\n\n1. It may cause denial-of-service. In fec_read_bufs, there is a loop that\nhas 253 iterations. For each iteration, we may call verity_hash_for_block\nrecursively. There is a limit of 4 nested recursions - that means that\nthere may be at most 253^4 (4 billion) iterations. Red Hat QE team\nactually created an image that pushes dm-verity to this limit - and this\nimage just makes the udev-worker process get stuck in the 'D' state.\n\n2. It doesn't work. In fec_read_bufs we store data into the variable\n\"fio->bufs\", but fio bufs is shared between recursive invocations, if\n\"verity_hash_for_block\" invoked correction recursively, it would\noverwrite partially filled fio->bufs."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndm-verity: deshabilitar la correcci\u00f3n de errores hacia adelante recursiva\n\nHay dos problemas con la correcci\u00f3n recursiva:\n\n1. Puede causar una denegaci\u00f3n de servicio. En fec_read_bufs, hay un bucle que tiene 253 iteraciones. Para cada iteraci\u00f3n, podemos llamar a verity_hash_for_block recursivamente. Hay un l\u00edmite de 4 recursiones anidadas, lo que significa que puede haber como m\u00e1ximo 253^4 (4 mil millones) iteraciones. El equipo de QE de Red Hat cre\u00f3 una imagen que lleva a dm-verity a este l\u00edmite, y esta imagen simplemente hace que el proceso udev-worker se quede atascado en el estado 'D'.\n\n2. No funciona. En fec_read_bufs almacenamos datos en la variable 'fio->bufs', pero fio bufs se comparte entre invocaciones recursivas; si 'verity_hash_for_block' invocara la correcci\u00f3n recursivamente, sobrescribir\u00eda los fio->bufs parcialmente llenos."}], "lastModified": "2026-03-25T11:16:14.790", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09F12E1C-9D38-454F-8AC2-792EBBD94320", "versionEndExcluding": "6.18.6", "versionStartIncluding": "4.5"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}