CVE-2025-71107: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-71107 is a NULL pointer dereference vulnerability in the Linux kernel's F2FS (Flash-Friendly File System) subsystem, caused by a race condition during filesystem unmount. Specifically, f2fs_put_super() can be called before all node page reads are completed, triggering a kernel panic with an "invalid opcode" exception. The vulnerability was published on January 14, 2026, and affects Linux kernel versions 6.4.16 through 6.5 (before 6.5), 6.5.1 through 6.6.119, 6.7 through 6.12.63, 6.13 through 6.18.2, and 6.19 release candidates. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, kernel.org patch).

The root cause is a race condition (CWE-476: NULL Pointer Dereference) in the F2FS filesystem's superblock teardown path. When f2fs_put_super() is invoked during unmount, it does not wait for all in-flight node page read I/O operations (F2FS_RD_NODE) to complete, resulting in a null pointer dereference when those reads attempt to reference already-freed structures. The fix adds a call to f2fs_wait_on_all_pages() for F2FS_RD_NODE before f2fs_put_super() proceeds, ensuring all pending reads are drained. Exploitation requires local access with low privileges (e.g., the ability to mount/unmount an F2FS filesystem), and the crash is intermittent, manifesting most reliably under xfstests generic/335 and generic/336 workloads (Feedly).

Successful triggering of this vulnerability causes a kernel panic ("kernel BUG at fs/f2fs/super.c:1939") with an invalid opcode exception, resulting in a complete system crash and denial of service. There is no confidentiality or integrity impact; the sole consequence is availability loss. Systems using F2FS filesystems — common in embedded, mobile, and flash-storage environments — are at risk of unplanned reboots and potential data loss if the system is forcibly shut down mid-operation (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, reflecting very low probability of exploitation in the near term. Exploitation requires local access with low privileges and is non-deterministic, further limiting practical risk (Feedly).

• Logs: Kernel log entries containing F2FS-fs (dm-X): detect filesystem reference count leak during umount, type: 9, count: 1 or kernel BUG at fs/f2fs/super.c:1939.
• Logs: Kernel oops traces referencing f2fs_put_super, generic_shutdown_super, kill_block_super, kill_f2fs_super, or deactivate_locked_super in the call stack.
• System Behavior: Unexpected system reboots or kernel panics occurring during unmount of F2FS-formatted volumes, particularly under heavy I/O workloads.

Kernel maintainers have released patches addressing this vulnerability. Users should update to the following fixed versions: 6.5 (or later in the 6.5.x series, specifically 6.6.120+), 6.12.64+, or 6.18.3+. Four upstream commits address the issue: 0b36fae, 297baa4, 3b15d5f, and c3031cf (kernel.org patch). Ubuntu has issued security notices USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, and USN-8257-1 covering affected kernel packages (Ubuntu USN-8177-1). As a temporary workaround where patching is not immediately possible, minimize frequent mount/unmount cycles of F2FS filesystems and monitor system logs for crash indicators.

Ubuntu issued multiple security notices (USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, USN-8257-1) addressing this and related kernel vulnerabilities (Ubuntu USN-8177-1, Ubuntu USN-8183-1). The Yocto Project security mailing list also discussed the issue in the context of embedded Linux distributions (Yocto Security List). No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability.