Linux Kernel up to 6.18.5 fec_read_bufs denial of service

Summaryinfo

A vulnerability was found in Linux Kernel up to 6.18.5 and classified as critical. Affected by this vulnerability is the function fec_read_bufs. Such manipulation leads to denial of service. This vulnerability is traded as CVE-2025-71161. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.18.5. It has been rated as critical. Affected by this issue is the function fec_read_bufs. The manipulation with an unknown input leads to a denial of service vulnerability. Using CWE to declare the problem leads to CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. Impacted is availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: dm-verity: disable recursive forward error correction There are two problems with the recursive correction: 1. It may cause denial-of-service. In fec_read_bufs, there is a loop that has 253 iterations. For each iteration, we may call verity_hash_for_block recursively. There is a limit of 4 nested recursions - that means that there may be at most 253^4 (4 billion) iterations. Red Hat QE team actually created an image that pushes dm-verity to this limit - and this image just makes the udev-worker process get stuck in the 'D' state. 2. It doesn't work. In fec_read_bufs we store data into the variable "fio->bufs", but fio bufs is shared between recursive invocations, if "verity_hash_for_block" invoked correction recursively, it would overwrite partially filled fio->bufs.

The advisory is shared for download at git.kernel.org. This vulnerability is handled as CVE-2025-71161 since 01/13/2026. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 296381 (Linux Distros Unpatched Vulnerability : CVE-2025-71161), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.18.6 or 6.19-rc1 eliminates this vulnerability. Applying the patch 232948cf600fba69aff36b25d85ef91a73a35756/d9f3e47d3fae0c101d9094bc956ed24e7a0ee801 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (296381) and CERT Bund (WID-SEC-2026-0215). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• Ubuntu Linux
• SUSE Linux
• Oracle Linux
• IBM QRadar SIEM
• SUSE openSUSE
• RESF Rocky Linux
• NetApp ActiveIQ Unified Manager
• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion