CVE-2025-71161

{"id": "CVE-2025-71161", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2026-01-23T16:15:53.000", "references": [{"url": "https://git.kernel.org/stable/c/232948cf600fba69aff36b25d85ef91a73a35756", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4220cb37406915c926c0e4a3dbab77cd9cceeb1e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/897d9006e75f46f8bd7df78faa424327ae6a4bcf", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/8b821ca892cfeeaf0bedc9fc72717294f67144d5", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d9f3e47d3fae0c101d9094bc956ed24e7a0ee801", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/e227d2b229c7529bd98d348efc55262ccf24ab35", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-193"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-verity: disable recursive forward error correction\n\nThere are two problems with the recursive correction:\n\n1. It may cause denial-of-service. In fec_read_bufs, there is a loop that\nhas 253 iterations. For each iteration, we may call verity_hash_for_block\nrecursively. There is a limit of 4 nested recursions - that means that\nthere may be at most 253^4 (4 billion) iterations. Red Hat QE team\nactually created an image that pushes dm-verity to this limit - and this\nimage just makes the udev-worker process get stuck in the 'D' state.\n\n2. It doesn't work. In fec_read_bufs we store data into the variable\n\"fio->bufs\", but fio bufs is shared between recursive invocations, if\n\"verity_hash_for_block\" invoked correction recursively, it would\noverwrite partially filled fio->bufs."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ndm-verity: deshabilitar la correcci\u00f3n de errores hacia adelante recursiva\n\nHay dos problemas con la correcci\u00f3n recursiva:\n\n1. Puede causar una denegaci\u00f3n de servicio. En fec_read_bufs, hay un bucle que tiene 253 iteraciones. Para cada iteraci\u00f3n, podemos llamar a verity_hash_for_block recursivamente. Hay un l\u00edmite de 4 recursiones anidadas, lo que significa que puede haber como m\u00e1ximo 253^4 (4 mil millones) iteraciones. El equipo de QE de Red Hat cre\u00f3 una imagen que lleva a dm-verity a este l\u00edmite, y esta imagen simplemente hace que el proceso udev-worker se quede atascado en el estado 'D'.\n\n2. No funciona. En fec_read_bufs almacenamos datos en la variable 'fio->bufs', pero fio bufs se comparte entre invocaciones recursivas; si 'verity_hash_for_block' invocara la correcci\u00f3n recursivamente, sobrescribir\u00eda los fio->bufs parcialmente llenos."}], "lastModified": "2026-06-01T17:16:38.587", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09F12E1C-9D38-454F-8AC2-792EBBD94320", "versionEndExcluding": "6.18.6", "versionStartIncluding": "4.5"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}