CVE-2025-71106: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71106 is a logic error vulnerability in the Linux kernel's filesystems_freeze_callback() function that causes incorrect file system freezing behavior, leading to denial of service. The bug was introduced by commit a3f8f8662771 ("power: always freeze efivarfs") and results in all file systems being frozen when filesystem_freeze_enabled is false — the opposite of the intended behavior. Affected versions include Linux kernel 6.18 (base), 6.18.1 through 6.18.2, and 6.19-rc1 through 6.19-rc8. It was published on January 14, 2026, with patches released on March 25, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, kernel.org patch).

The root cause is a logic inversion (CWE classified as insufficient information by NVD) in the freeze_all_ptr condition check within filesystems_freeze_callback(). When filesystem_freeze_enabled is false, the reversed boolean check incorrectly triggers a freeze of all file systems rather than skipping it. This causes WARN_ON_ONCE() warnings to fire in __set_task_frozen() because the kernel attempts to freeze file systems that are not in a state ready for freezing. Exploitation requires local access with low privileges, as an attacker or unprivileged user can trigger the erroneous freeze path by interacting with the power management subsystem (Feedly, kernel.org patch).

Successful triggering of this vulnerability results in a high availability impact: all file systems may be incorrectly frozen, causing system instability, application failures, and potential hang conditions. There is no confidentiality or integrity impact. The incorrect freezing can prevent normal file system operations, rendering affected systems unresponsive until the condition is resolved, which may require a reboot (Feedly).

Upgrade the Linux kernel to version 6.18.3 or later to resolve this issue. For systems running 6.19 release candidates, upgrade to the final 6.19 release or a later stable version. Patches are available in the kernel stable repositories at the two referenced commits. As a temporary workaround, disabling automatic file system freezing operations (if operationally feasible) may mitigate the impact until patching is possible (kernel.org patch, kernel.org patch 2).