CVE-2025-71117: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71117 is a deadlock vulnerability in the Linux kernel's block I/O subsystem caused by improper locking (CWE-667) when freezing request queues from within sysfs store callbacks. It affects Linux kernel versions 6.11 and 6.11.1 through 6.18.2, as well as 6.19-rc1 through 6.19-rc8. The vulnerability was published on January 14, 2026, with NVD initial analysis completed on March 25, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, kernel.org).

The root cause is improper locking (CWE-667): the blk_mq_freeze_queue() and blk_mq_unfreeze_queue() calls inside sysfs store callbacks for attributes io_poll_delay, io_timeout, nomerges, read_ahead_kb, and rq_affinity can create a circular wait condition. The deadlock occurs when multipathd holds a dm-multipath lock while attempting to call dm_table_set_restrictions(), and simultaneously a udev worker process writes to a sysfs queue attribute (e.g., read_ahead_kb), causing blk_mq_freeze_queue_wait() to block indefinitely. The interaction is specifically triggered when the dm-multipath driver is configured with the queue_if_no_path option. The fix removes unnecessary queue freeze calls from these callbacks and adds the __data_racy annotation to request_queue.rq_timeout to suppress KCSAN data race reports (Feedly, kernel.org).

Successful triggering of this vulnerability results in a system deadlock where the kernel scheduler becomes blocked, causing hung processes and potential system hangs that may require a hard reboot — a high availability impact with no confidentiality or integrity impact. Systems using dm-multipath with queue_if_no_path are at highest risk, particularly during boot when udev workers concurrently write sysfs queue attributes. Additionally, even without a full deadlock, the unnecessary queue freezing operations introduce performance degradation during system boot on systems that set sysfs attributes synchronously (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges (a local user or process capable of writing to sysfs queue attributes) and is most reliably triggered in environments running dm-multipath with queue_if_no_path enabled alongside concurrent udev activity. The EPSS score is approximately 0.018% (0.000180), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing hung task warnings involving multipathd or udev-worker processes; stack traces referencing blk_mq_freeze_queue_wait, queue_ra_store, dm_table_set_restrictions, or dm_swap_table.
• Process: Processes in uninterruptible sleep (D state) — observable via ps aux or top — specifically multipathd or udev-worker that do not recover.
• System Behavior: System becoming unresponsive during boot or during dm-multipath reconfiguration events, particularly on storage-heavy systems with multipath configured.

Update the Linux kernel to version 6.18.3 or later, which removes the unnecessary blk_mq_freeze_queue() / blk_mq_unfreeze_queue() calls from the affected sysfs store callbacks. Two upstream commits address this issue: commit 3997b31 and commit 935a20d. As a temporary workaround on unpatched systems, avoid simultaneous dm-multipath reconfiguration operations and sysfs attribute modifications, and prioritize patching on systems using dm-multipath with queue_if_no_path enabled (Feedly, kernel.org).