CVE-2025-71105: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71105 is a denial-of-service vulnerability in the Linux kernel's f2fs (Flash-Friendly File System) implementation caused by improper handling of per-superblock inline extended attribute slab caches. When multiple f2fs filesystems are mounted and unmounted in certain sequences, the kernel's slab allocator detects duplicate cache names and triggers a warning, causing subsequent remount operations to fail. The vulnerability affects Linux kernel versions 5.7 through 6.18.2 across multiple stable branches, including 5.7.1–5.10.247, 5.11–5.15.197, 5.16–6.1.159, 6.2–6.6.119, 6.7–6.12.63, and 6.13–6.18.2. It was published on January 14, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is a reference counting flaw (classified as NVD-CWE-noinfo / insufficient information) in f2fs_init_xattr_caches() within fs/f2fs/xattr.c. When two f2fs filesystems are mounted with the same inline xattr size, the kernel slab allocator merges their per-superblock caches into a single underlying structure while maintaining separate name entries. Destroying one cache only decrements the reference count rather than fully releasing it; when the same filesystem is remounted, the kernel finds a cache with the same name already registered and triggers a kmem_cache_sanity_check warning in mm/slab_common.c, preventing the mount from completing. The bug is reproducible by mounting two f2fs devices, unmounting one, and remounting it — a sequence common in container and dynamic storage environments (Feedly).

Exploitation of this vulnerability results in a denial-of-service condition affecting filesystem availability. Repeated mount/unmount cycles of f2fs filesystems cause remount failures, disrupting containerized workloads, embedded systems with removable storage, and cloud infrastructure relying on dynamic volume management. There is no confidentiality or integrity impact; the vulnerability is limited to availability (A:H in CVSS terms), and there is no known potential for lateral movement or data exposure (Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability requires local access with low privileges (a user capable of mounting filesystems) and is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.018% (0.000180), reflecting very low likelihood of exploitation in the near term (Feedly).

• Logs: Kernel warning messages in dmesg or /var/log/kern.log containing kmem_cache of name 'f2fs_xattr_entry-X:X' already exists and WARNING: CPU: ... at mm/slab_common.c:110 kmem_cache_sanity_check.
• Logs: Failed mount system calls for f2fs devices following a prior unmount, visible in audit logs or strace output showing EEXIST or similar errors during f2fs_fill_super.
• Process: Repeated invocations of mount/umount for the same f2fs block device in a short time window, potentially visible in process accounting or container orchestration logs.

Update the Linux kernel to a patched stable version: 5.10.248 or later (5.10.x branch), 5.15.198 or later (5.15.x branch), 6.1.160 or later (6.1.x branch), 6.6.120 or later (6.6.x branch), 6.12.64 or later (6.12.x branch), or 6.18.3 or later (6.18.x branch). The fix replaces per-superblock inline_xattr_slab caches with a single global slab cache, eliminating the duplicate name collision. As a temporary workaround for systems that cannot be patched immediately, restrict f2fs mount permissions to trusted users only and minimize repeated mount/unmount cycles on the same f2fs device (Feedly, kernel.org patch).

The vulnerability was originally reported by Hong Yun to the Linux kernel mailing list, which led to the upstream fix. Debian issued a Long Term Support advisory (DLA-4475-1) and Ubuntu published security notices USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, and USN-8257-1 addressing this and related kernel issues. No significant broader media coverage or notable researcher commentary beyond standard distribution advisories has been observed (Feedly).