CVE-2025-71237: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71237 is an integer underflow vulnerability in the Linux kernel's nilfs2 filesystem implementation affecting the FITRIM command processing. When a user executes FITRIM with an end_block value that is too small, an underflow occurs in the nblocks calculation; since nblocks is of type sector_t (u64), the negative result wraps around to an extremely large positive integer, causing the block layer's __blkdev_issue_discard() to process an abnormally large bio chain and hold the ns_segctor_sem lock indefinitely. This results in a system hang as reported by syzbot. Affected Linux kernel versions span 3.15/5.10.x through 6.19.x across multiple stable branches, with fixed versions at 5.10.251, 5.15.201, 6.1.164, 6.6.125, 6.12.72, 6.18.11, and 6.19.1. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Microsoft MSRC).

The root cause is an integer underflow (CWE-191) in the nilfs2 FITRIM handler: when end_block is smaller than expected (e.g., less than a 4KiB range), the subtraction used to compute nblocks produces a negative result that, due to the unsigned sector_t (u64) type, wraps to a very large positive integer. This malformed value is passed to __blkdev_issue_discard(), which then attempts to process an excessively large bio chain, holding the ns_segctor_sem semaphore for an extended period and blocking all other tasks that need this lock. Exploitation requires local access with low privileges (the ability to issue FITRIM on a nilfs2-mounted filesystem). The fix exits early and assigns a discarded size of 0 to range->len when the ending block is too small, treating the operation as a no-op without returning an error (Red Hat CVE, Kernel Patch).

Successful exploitation allows an unprivileged local user to trigger a system-wide denial of service by causing the kernel to hang indefinitely. The ns_segctor_sem lock is held for an excessive duration while the block layer processes the malformed discard request, preventing other tasks from acquiring the lock and rendering the system unresponsive. There is no confidentiality or integrity impact; the vulnerability is limited to availability (system hang/crash). The broad version range affected — spanning Linux kernel 5.10 through 6.19 across multiple stable branches — means a wide variety of Linux distributions and embedded systems are potentially impacted (Red Hat CVE).

Apply kernel updates to the following fixed versions based on your deployed branch: 5.10.251, 5.15.201, 6.1.164, 6.6.125, 6.12.72, 6.18.11, or 6.19.1. Microsoft has released patches for CBL-Mariner 2 (cbl2_kernel_5.15.200.1-1) and Azure Linux 3 (azl3_kernel_6.6.121.1-1). Debian has issued DSA-6163-1 and DLA-4499-1 for affected stable branches, and Amazon Linux 2 has released ALAS2KERNEL-5.10-2026-114. As a temporary workaround where immediate patching is not possible, restrict filesystem-level access controls to prevent unprivileged users from executing FITRIM commands on nilfs2-mounted filesystems, and monitor for kernel hangs or prolonged lock contention involving the nilfs2 segctor thread (Red Hat CVE, Microsoft MSRC, Kernel Patch).