LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71161: dm-verity: disable recursive forward error correction

In the Linux kernel, the following vulnerability has been resolved: dm-verity: disable recursive forward error correction There are two problems with the recursive correction: 1. It may cause denial-of-service. In fec_read_bufs, there is a loop that has 253 iterations. For each iteration, we may call verity_hash_for_block recursively. There is a limit of 4 nested recursions - that means that there may be at most 253^4 (4 billion) iterations. Red Hat QE team actually created an image that pushes dm-verity to this limit - and this image just makes the udev-worker process get stuck in the 'D' state. 2. It doesn't work. In fec_read_bufs we store data into the variable "fio->bufs", but fio bufs is shared between recursive invocations, if "verity_hash_for_block" invoked correction recursively, it would overwrite partially filled fio->bufs.

UnknownCVSS not scoredNot KEV-listedUpdated
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This Linux kernel flaw affects dm-verity when forward error correction recursively tries to repair data. A crafted verity image can force enormous repeated work and leave a process stuck in uninterruptible sleep, causing denial of service. The bundle provides no CVSS score or confirmed exploitation.

Executive priority

Treat this as a denial-of-service risk for Linux-based platforms using dm-verity FEC, especially embedded or appliance fleets. It is not currently evidenced as actively exploited, but systems depending on verified images should be patched through normal kernel/vendor update channels.

Technical view

dm-verity FEC could recurse through verity_hash_for_block from fec_read_bufs. With 253 loop iterations and four nested recursions, worst-case work can become billions of iterations. The shared fio->bufs state is also overwritten across recursive calls, so the correction path is both unsafe and ineffective.

Likely exposure

Linux systems using affected kernels with dm-verity forward error correction are the relevant exposure. This most likely matters for appliances, embedded systems, secure-boot-style image verification, and distributions enabling dm-verity images. Siemens advisories indicate downstream product relevance, but affected product details must be read from those advisories.

Exploitation context

The CVE record describes denial of service from a specially created image and says Red Hat QE reproduced a stuck udev-worker process. KEV is false, and the supplied sources do not state active exploitation or public exploit availability.

Researcher notes

Evidence is strongest for the kernel bug mechanics and DoS condition. The bundle does not include CVSS, CWE mapping, exploit status, or detailed downstream affected Siemens product matrices. Avoid broad claims beyond Linux dm-verity FEC and cited vendor advisories.

Mitigation direction

  • Update to a vendor kernel containing the referenced stable dm-verity fixes.
  • Check Linux distribution advisories for fixed package versions and backports.
  • Review Siemens SSA-082556 and SSA-019113 for affected Siemens products.
  • Prioritize systems that boot or mount dm-verity images from less-trusted sources.
  • If no patch is available, follow vendor guidance rather than applying speculative workarounds.

Validation and detection

  • Inventory kernels and identify systems using dm-verity with forward error correction.
  • Compare deployed kernel builds against vendor advisories or the referenced stable commits.
  • Check whether Siemens products in scope match SSA-082556 or SSA-019113.
  • Monitor for udev-worker or related processes stuck in uninterruptible sleep during image verification.
  • Confirm remediation through vendor kernel version or changelog evidence.
Prepared
Confidence
medium
Sources
10

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71161 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container
Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxa739ff3f543afbb4a041c16cd0182c8e8d366e70, a739ff3f543afbb4a041c16cd0182c8e8d366e70, a739ff3f543afbb4a041c16cd0182c8e8d366e70, a739ff3f543afbb4a041c16cd0182c8e8d366e70, a739ff3f543afbb4a041c16cd0182c8e8d366e70, a739ff3f543afbb4a041c16cd0182c8e8d366e70unaffected
LinuxLinux4.5, 0, 5.15.209, 6.1.167, 6.6.130, 6.12.78, 6.18.6, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.