CVE-2025-71123: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71123 is a buffer overflow vulnerability in the Linux kernel's ext4 filesystem mount option parsing code, specifically in the parse_apply_sb_mount_options() function in fs/ext4/super.c. The flaw arises from improper use of strscpy_pad() to copy a non-NUL-terminated string into a NUL-terminated buffer, triggering a kernel fortify buffer overflow warning and potential kernel panic. It was published on January 14, 2026, and affects multiple stable Linux kernel versions. The CVSS v3.1 base score is 7.8 (High) (Feedly, kernel.org patches).

The root cause is an incorrect string copy operation in parse_apply_sb_mount_options() (fs/ext4/super.c:2504): strscpy_pad() is called to copy the s_mount_opts superblock field — which may not be NUL-terminated — into a destination buffer that could be larger than the source. The kernel's fortify-string infrastructure detects this as a buffer overflow (strnlen: detected buffer overflow: 65 byte read of buffer size 64) and triggers __fortify_panic, causing a kernel panic. Exploitation requires a local attacker with low privileges to mount a crafted ext4 filesystem image with a non-NUL-terminated s_mount_opts field (up to 64 bytes). The vulnerability was discovered by the Linux Verification Center (linuxtesting.org) using Syzkaller fuzzing (Feedly).

A local attacker with low privileges can trigger a kernel panic (denial of service) by mounting a specially crafted ext4 filesystem with a malformed, non-NUL-terminated s_mount_opts field. The CVSS assessment rates confidentiality, integrity, and availability impacts all as High, indicating potential for information disclosure or arbitrary code execution in kernel context beyond the confirmed denial-of-service scenario, though the primary confirmed impact is a kernel panic (Feedly).

• Logs: Kernel log entries containing strnlen: detected buffer overflow: 65 byte read of buffer size 64 or WARNING: CPU: X PID: XXXXX at lib/string_helpers.c:1032 __fortify_report during ext4 mount operations.
• Logs: Kernel panic or oops traces referencing the call chain: __fortify_panic → strnlen → sized_strscpy → parse_apply_sb_mount_options → ext4_fill_super → get_tree_bdev_flags → vfs_get_tree → path_mount.
• Process: Unexpected termination or crash of processes attempting to mount ext4 filesystems, particularly with unusual or oversized mount option strings.

Apply the available kernel patches for the affected stable branches. Fixed versions include: 5.10.248+, 6.1.160+, 6.6.120+, 6.12.64+, 6.18.3+, and 6.17.4+ (mainline). Patch commits are available at git.kernel.org with hashes 52ac96c4, 5bbacbbf, 6e371435, 902ca235, db9ee13f, and ee5a977b. As a workaround, restrict local user access to mount operations and avoid mounting untrusted ext4 filesystem images (Feedly, kernel.org patches).