In the Linux kernel, the following vulnerability has been resolved:
dm-verity: disable recursive forward error correction
There are two problems with the recursive correction:
1. It may cause denial-of-service. In fec_read_bufs, there is a loop that
has 253 iterations. For each iteration, we may call verity_hash_for_block
recursively. There is a limit of 4 nested recursions - that means that
there may be at most 253^4 (4 billion) iterations. Red Hat QE team
actually created an image that pushes dm-verity to this limit - and this
image just makes the udev-worker process get stuck in the 'D' state.
2. It doesn't work. In fec_read_bufs we store data into the variable
"fio->bufs", but fio bufs is shared between recursive invocations, if
"verity_hash_for_block" invoked correction recursively, it would
overwrite partially filled fio->bufs.
dm-verity: disable recursive forward error correction
There are two problems with the recursive correction:
1. It may cause denial-of-service. In fec_read_bufs, there is a loop that
has 253 iterations. For each iteration, we may call verity_hash_for_block
recursively. There is a limit of 4 nested recursions - that means that
there may be at most 253^4 (4 billion) iterations. Red Hat QE team
actually created an image that pushes dm-verity to this limit - and this
image just makes the udev-worker process get stuck in the 'D' state.
2. It doesn't work. In fec_read_bufs we store data into the variable
"fio->bufs", but fio bufs is shared between recursive invocations, if
"verity_hash_for_block" invoked correction recursively, it would
overwrite partially filled fio->bufs.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux | unaffected |
|
|||||||||||||||||||||||||||
| Linux | Linux | affected |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 Debian DLA |
DLA-4561-1 | linux-6.1 security update |
 Debian DSA |
DSA-6238-1 | linux security update |
| Debian DSA |
DSA-6243-1 | linux security update |
 Ubuntu USN |
USN-8567-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-8570-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-8574-1 | Linux kernel (GCP FIPS) vulnerabilities |
| Ubuntu USN |
USN-8575-1 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-8576-1 | Linux kernel (NVIDIA Tegra) vulnerabilities |
| Ubuntu USN |
USN-8574-2 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-8594-1 | Linux kernel (OEM) vulnerabilities |
| Ubuntu USN |
USN-8595-1 | Linux kernel (Oracle) vulnerabilities |
| Ubuntu USN |
USN-8596-1 | Linux kernel (NVIDIA) vulnerabilities |
| Ubuntu USN |
USN-8575-2 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-8576-2 | Linux kernel (NVIDIA Tegra) vulnerabilities |
| Ubuntu USN |
USN-8597-1 | Linux kernel (IBM) vulnerabilities |
| Ubuntu USN |
USN-8575-3 | Linux kernel vulnerabilities |
| Ubuntu USN |
USN-8595-2 | Linux kernel (AWS) vulnerabilities |
| Ubuntu USN |
USN-8604-1 | Linux kernel (Azure) vulnerabilities |
| Ubuntu USN |
USN-8605-1 | Linux kernel (Azure CVM) vulnerabilities |
| Ubuntu USN |
USN-8606-1 | Linux kernel (Azure) vulnerabilities |
| Ubuntu USN |
USN-8607-1 | Linux kernel (Azure CVM) vulnerabilities |
| Ubuntu USN |
USN-8608-1 | Linux kernel (Azure FIPS) vulnerabilities |
| Ubuntu USN |
USN-8609-1 | Linux kernel (Azure CVM) vulnerabilities |
| Ubuntu USN |
USN-8610-1 | Linux kernel (Azure CVM) vulnerabilities |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Mon, 01 Jun 2026 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Wed, 25 Mar 2026 10:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Thu, 26 Feb 2026 20:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-193 |
Sat, 24 Jan 2026 00:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
cvssV3_1
|
Fri, 23 Jan 2026 15:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In the Linux kernel, the following vulnerability has been resolved: dm-verity: disable recursive forward error correction There are two problems with the recursive correction: 1. It may cause denial-of-service. In fec_read_bufs, there is a loop that has 253 iterations. For each iteration, we may call verity_hash_for_block recursively. There is a limit of 4 nested recursions - that means that there may be at most 253^4 (4 billion) iterations. Red Hat QE team actually created an image that pushes dm-verity to this limit - and this image just makes the udev-worker process get stuck in the 'D' state. 2. It doesn't work. In fec_read_bufs we store data into the variable "fio->bufs", but fio bufs is shared between recursive invocations, if "verity_hash_for_block" invoked correction recursively, it would overwrite partially filled fio->bufs. | |
| Title | dm-verity: disable recursive forward error correction | |
| First Time appeared |
Linux
Linux linux Kernel |
|
| CPEs | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Linux
Linux linux Kernel |
|
| References |
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Linux
Published:
Updated: 2026-07-14T12:44:48.463Z
Reserved: 2026-01-13T15:30:19.665Z
Link: CVE-2025-71161
Vulnrichment
No data.
NVD
Status : Modified
Published: 2026-01-23T16:15:53.000
Modified: 2026-06-17T10:03:47.087
Link: CVE-2025-71161
Redhat
OpenCVE Enrichment
No data.
Weaknesses