CVE-2025-71065: 
CBL Mariner vulnerability analysis and mitigation

CVE-2025-71065 is a deadlock vulnerability in the Linux kernel's f2fs (Flash-Friendly File System) implementation, caused by a circular locking dependency that can result in denial of service. The flaw was reported by Jiaming Zhang and syzbot and published on January 13, 2026. It affects Linux kernel versions with f2fs support, and Microsoft's Azure Linux (azl3_kernel_6.6.119.3-3) is among the confirmed affected products. The CVSS v3.1 base score is 5.0 (Medium), requiring local access, low privileges, and user interaction (Feedly, Microsoft MSRC).

The root cause is a circular lock dependency (CWE-667: Improper Locking) involving four kernel locks: fs_reclaim, sb_internal (sb_start_intwrite), &sbi->cp_rwsem (f2fs_lock_op), and f2fs_down_write. The deadlock chain can be triggered through multiple code paths: inode eviction (f2fs_evict_inode), atomic write commits, and file attribute lookups during open operations. Specifically, kswapd can hold fs_reclaim and sb_internal while attempting to acquire &sbi->cp_rwsem, while another thread holds sb_internal and waits for fs_reclaim, creating a classic ABBA deadlock. The vulnerability was identified via kernel lockdep tooling and reported with a full stack trace showing the unsafe locking scenario (Feedly).

Successful exploitation causes system hangs and denial of service conditions, with no impact on confidentiality or integrity. An unprivileged local user can trigger the deadlock by performing specific f2fs file system operations — such as executing ioctls for atomic writes, opening files with security attributes, or initiating memory reclamation — causing affected processes to become unresponsive and potentially requiring a system restart. The impact is limited to availability on systems running vulnerable Linux kernel versions with f2fs support enabled (Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access, low privileges, and user interaction, significantly limiting its attack surface. The EPSS score is approximately 0.018% (0.000180), reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) containing lockdep warnings such as WARNING: possible circular locking dependency detected, referencing fs_reclaim, sb_internal, or cp_rwsem locks in f2fs context.
• Process Behavior: kswapd process becoming unresponsive or stuck; processes in uninterruptible sleep (D state) related to f2fs inode eviction or atomic write operations.
• System: System-wide hangs or freezes on hosts using f2fs file systems, particularly during memory pressure events or heavy file I/O.

Apply the latest Linux kernel security updates that include the f2fs deadlock fix. For Microsoft Azure Linux, the patch was made available as of January 15, 2026 (azl3_kernel_6.6.119.3-3 and later). Ubuntu security notices USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, and USN-8257-1 also address this vulnerability. As a temporary workaround where patching is not immediately possible, consider restricting f2fs usage or disabling atomic write operations, and monitor kernel logs for deadlock warning events (Feedly, Ubuntu USN-8177-1, Microsoft MSRC).