{"id":"CVE-2025-71161","summary":"dm-verity: disable recursive forward error correction","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ndm-verity: disable recursive forward error correction\n\nThere are two problems with the recursive correction:\n\n1. It may cause denial-of-service. In fec_read_bufs, there is a loop that\nhas 253 iterations. For each iteration, we may call verity_hash_for_block\nrecursively. There is a limit of 4 nested recursions - that means that\nthere may be at most 253^4 (4 billion) iterations. Red Hat QE team\nactually created an image that pushes dm-verity to this limit - and this\nimage just makes the udev-worker process get stuck in the 'D' state.\n\n2. It doesn't work. In fec_read_bufs we store data into the variable\n\"fio-\u003ebufs\", but fio bufs is shared between recursive invocations, if\n\"verity_hash_for_block\" invoked correction recursively, it would\noverwrite partially filled fio-\u003ebufs.","modified":"2026-04-02T17:30:50.367977803Z","published":"2026-01-23T15:23:59.464Z","related":["CGA-j7h5-cj82-h2r6","SUSE-SU-2026:20838-1","SUSE-SU-2026:20931-1","openSUSE-SU-2026:20416-1"],"database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71161.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/232948cf600fba69aff36b25d85ef91a73a35756"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4220cb37406915c926c0e4a3dbab77cd9cceeb1e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/897d9006e75f46f8bd7df78faa424327ae6a4bcf"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d9f3e47d3fae0c101d9094bc956ed24e7a0ee801"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e227d2b229c7529bd98d348efc55262ccf24ab35"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71161.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-71161"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"a739ff3f543afbb4a041c16cd0182c8e8d366e70"},{"fixed":"e227d2b229c7529bd98d348efc55262ccf24ab35"},{"fixed":"897d9006e75f46f8bd7df78faa424327ae6a4bcf"},{"fixed":"4220cb37406915c926c0e4a3dbab77cd9cceeb1e"},{"fixed":"232948cf600fba69aff36b25d85ef91a73a35756"},{"fixed":"d9f3e47d3fae0c101d9094bc956ed24e7a0ee801"}]}],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-71161.json"}}],"schema_version":"1.7.5"}