CVE-2025-71161: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71161 is a denial-of-service vulnerability in the Linux kernel's dm-verity module caused by flawed recursive forward error correction (FEC) logic. It affects Linux kernel versions 4.5 through 6.18.5 (fixed in 6.18.6). The vulnerability was disclosed on January 23, 2026, and is classified as CVSS v3.1 base score 5.5 (Medium) with a local attack vector requiring low privileges (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability (CWE-193: Off-by-one Error) stems from two compounding defects in the fec_read_bufs function within the dm-verity module. First, a loop with up to 253 iterations may recursively call verity_hash_for_block, and with a recursion depth limit of 4, this can produce up to 253^4 (~4 billion) total iterations, causing the udev-worker process to enter an uninterruptible 'D' (disk sleep) state. Second, the shared buffer fio->bufs is not protected across recursive invocations — when verity_hash_for_block triggers recursive correction, it overwrites partially filled buffer data, causing both functional failure and potential data corruption in the FEC path. Exploitation requires a locally accessible, specially crafted dm-verity image (Red Hat Bugzilla, Kernel Patch).

Successful exploitation causes affected processes (notably udev-worker) to become stuck in an uninterruptible sleep state, effectively freezing system availability without any impact to confidentiality or integrity. A local attacker with low privileges can craft a malicious dm-verity image to trigger this condition, potentially disrupting device management and system operations. The vulnerability does not enable privilege escalation, code execution, or data exfiltration (Red Hat Advisory, Red Hat Bugzilla).

1. Prerequisite: Obtain local access to a Linux system running kernel versions 4.5–6.18.5 with dm-verity enabled and low-privilege user access.
2. Craft malicious image: Create a dm-verity formatted disk image specifically designed to trigger the recursive FEC path — the image must contain data patterns that cause verity_hash_for_block to invoke FEC correction recursively up to 4 levels deep, with each level iterating up to 253 times.
3. Mount or present the image: Use available local mechanisms (e.g., loop device) to present the crafted image to the dm-verity subsystem, causing fec_read_bufs to be invoked.
4. Trigger DoS: The recursive FEC logic executes up to ~4 billion iterations, causing the udev-worker process to enter an uninterruptible 'D' state and hang, degrading system availability (Red Hat Bugzilla).

• Process: Processes (particularly udev-worker) stuck in uninterruptible 'D' (disk sleep) state for extended periods, visible via ps aux or top output.
• Logs: Kernel logs (dmesg, /var/log/kern.log) may show dm-verity or FEC-related warnings or stall messages; system logs may record hung task warnings referencing fec_read_bufs or verity_hash_for_block.
• System Behavior: Unusual system sluggishness or device management failures (udev not processing events) coinciding with mounting of external or untrusted dm-verity images.

Apply kernel patches available in Linux kernel version 6.18.6 and later, which disable recursive forward error correction in dm-verity. Multiple stable-branch patches have been released via the kernel stable repository (Kernel Patch, Kernel Patch). Downstream distributions including Debian, Amazon Linux 2023, and SUSE have released updated kernel packages. If immediate patching is not feasible, restrict local system access to trusted users only and consider disabling dm-verity if it is not operationally required (Red Hat Advisory).

Red Hat's QE team was credited with discovering and demonstrating the vulnerability by constructing a proof-of-concept image that triggers the recursive FEC limit, leading to the upstream kernel fix. The issue was tracked in Red Hat Bugzilla (Bug 2432401) and the upstream advisory was published via the linux-cve-announce mailing list. Downstream distributions including Debian (DSA-6238-1, DSA-6243-1, DLA-4561-1), Amazon Linux 2023, SUSE, and Yocto Project have all issued security advisories and updated kernel packages (Red Hat Bugzilla, Debian DSA).