CVE-2025-71237 - Vulnerability Details

- nilfs2: Fix potential block overflow that cause system hang

Description

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: Fix potential block overflow that cause system hang

When a user executes the FITRIM command, an underflow can occur when
calculating nblocks if end_block is too small. Since nblocks is of
type sector_t, which is u64, a negative nblocks value will become a
very large positive integer. This ultimately leads to the block layer
function __blkdev_issue_discard() taking an excessively long time to
process the bio chain, and the ns_segctor_sem lock remains held for a
long period. This prevents other tasks from acquiring the ns_segctor_sem
lock, resulting in the hang reported by syzbot in [1].

If the ending block is too small, typically if it is smaller than 4KiB
range, depending on the usage of the segment 0, it may be possible to
attempt a discard request beyond the device size causing the hang.

Exiting successfully and assign the discarded size (0 in this case)
to range->len.

Although the start and len values in the user input range are too small,
a conservative strategy is adopted here to safely ignore them, which is
equivalent to a no-op; it will not perform any trimming and will not
throw an error.

[1]
task:segctord state:D stack:28968 pid:6093 tgid:6093 ppid:2 task_flags:0x200040 flags:0x00080000
Call Trace:
rwbase_write_lock+0x3dd/0x750 kernel/locking/rwbase_rt.c:272
nilfs_transaction_lock+0x253/0x4c0 fs/nilfs2/segment.c:357
nilfs_segctor_thread_construct fs/nilfs2/segment.c:2569 [inline]
nilfs_segctor_thread+0x6ec/0xe00 fs/nilfs2/segment.c:2684

[ryusuke: corrected part of the commit message about the consequences]

Published: 2026-02-18

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An overflow in the nilfs2 filesystem occurs when the FITRIM command calculates the number of blocks to discard. If the supplied end block is too small, the unsigned sector_t calculation underflows, turning a negative number into a very large positive value. This causes the kernel’s block layer to issue an excessively large discard request, holding a semaphore for an extended period and preventing other tasks from progressing. The result is a system hang, as observed by the syzbot test harness. The weakness is a signed to unsigned conversion error (CWE‑193).

Affected Systems

The vulnerability affects all releases of the Linux kernel that include the nilfs2 filesystem implementation, with no specific version range provided. Any system running Linux that mounts a nilfs2 filesystem and permits FITRIM operations is susceptible.

Risk and Exploitability

The CVSS score of 5.5 reflects a moderate impact, and the EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. It is inferred that attackers would need local or privileged access to issue a FITRIM command on a nilfs2 filesystem; the flaw is thus a local denial-of-service threat that would affect system availability by preventing other processes from acquiring a key mutex lock.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`82e11e857be3ffd2a0a952c9db8aa2379e2b9e44`	affected	< 6457d3ee41a4c15082ac49c5aa7fb933b4a043f3
`82e11e857be3ffd2a0a952c9db8aa2379e2b9e44`	affected	< ba18e5f22f26aa4ef78bc3e81f639d1d4f3845e6
`82e11e857be3ffd2a0a952c9db8aa2379e2b9e44`	affected	< 2438982f635e6cc2009be68ba2efb2998727d8d4
`82e11e857be3ffd2a0a952c9db8aa2379e2b9e44`	affected	< df1e20796c9f3d541cca47fb72e4369ea135642d
`82e11e857be3ffd2a0a952c9db8aa2379e2b9e44`	affected	< ea2278657ad0d62596589fbe2caf995e189e65e7
`82e11e857be3ffd2a0a952c9db8aa2379e2b9e44`	affected	< 4aa45f841413cca81882602b4042c53502f34cad
`82e11e857be3ffd2a0a952c9db8aa2379e2b9e44`	affected	< b8c5ee234bd54f1447c846101fdaef2cf70c2149
`82e11e857be3ffd2a0a952c9db8aa2379e2b9e44`	affected	< ed527ef0c264e4bed6c7b2a158ddf516b17f5f66

Linux

affected

Version	Status	Constraints
`3.15`	affected	—
`0`	unaffected	< 3.15
`5.10.251`	unaffected	≤ 5.10.*
`5.15.201`	unaffected	≤ 5.15.*
`6.1.164`	unaffected	≤ 6.1.*
`6.6.125`	unaffected	≤ 6.6.*
`6.12.72`	unaffected	≤ 6.12.*
`6.18.11`	unaffected	≤ 6.18.*
`6.19.1`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,df1e20796c9f3d541cca47fb72e4369ea135642d)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ea2278657ad0d62596589fbe2caf995e189e65e7)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4aa45f841413cca81882602b4042c53502f34cad)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b8c5ee234bd54f1447c846101fdaef2cf70c2149)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.6.125,6.7.0)`	unaffected	semver	—
`[6.12.72,6.13.0)`	unaffected	semver	—
`[6.18.11,6.19.0)`	unaffected	semver	—
`[6.19.1,6.20.0)`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that contains the nilfs2 block overflow fix (commit 2438982f6 and related patches).
If an immediate kernel update is not possible, avoid using the FITRIM command on nilfs2 filesystems; instead use alternative data-correction methods that do not trigger discard.
For systems that must perform trims, ensure that the end block argument is validated to be at least a page (4 KiB) or higher before invoking FITRIM, or use a wrapper that suppresses small values.

Generated by OpenCVE AI on April 20, 2026 at 20:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4498-1	linux security update
Debian DLA	DLA-4499-1	linux-6.1 security update
Debian DSA	DSA-6141-1	linux security update
Debian DSA	DSA-6163-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00031.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2438982f635e6cc2009be68ba2efb2998727d8d4
https://git.kernel.org/stable/c/4aa45f841413cca81882602b4042c53502f34cad
https://git.kernel.org/stable/c/6457d3ee41a4c15082ac49c5aa7fb933b4a043f3
https://git.kernel.org/stable/c/b8c5ee234bd54f1447c846101fdaef2cf70c2149
https://git.kernel.org/stable/c/ba18e5f22f26aa4ef78bc3e81f639d1d4f3845e6
https://git.kernel.org/stable/c/df1e20796c9f3d541cca47fb72e4369ea135642d
https://git.kernel.org/stable/c/ea2278657ad0d62596589fbe2caf995e189e65e7
https://git.kernel.org/stable/c/ed527ef0c264e4bed6c7b2a158ddf516b17f5f66
https://lore.kernel.org/linux-cve-announce/2026021806-CVE-2025-71237-545a@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2025-71237
https://www.cve.org/CVERecord?id=CVE-2025-71237

History

Mon, 20 Apr 2026 21:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-193

Wed, 18 Mar 2026 15:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
Metrics		cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Mon, 23 Feb 2026 03:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/ed527ef0c264e4bed6c7b2a158ddf516b17f5f66

Thu, 19 Feb 2026 16:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/2438982f635e6cc2009be68ba2efb2998727d8d4 https://git.kernel.org/stable/c/6457d3ee41a4c15082ac49c5aa7fb933b4a043f3 https://git.kernel.org/stable/c/ba18e5f22f26aa4ef78bc3e81f639d1d4f3845e6

Thu, 19 Feb 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026021806-CVE-2025-71237-545a@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2025-71237 https://www.cve.org/CVERecord?id=CVE-2025-71237

Wed, 18 Feb 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nilfs2: Fix potential block overflow that cause system hang When a user executes the FITRIM command, an underflow can occur when calculating nblocks if end_block is too small. Since nblocks is of type sector_t, which is u64, a negative nblocks value will become a very large positive integer. This ultimately leads to the block layer function __blkdev_issue_discard() taking an excessively long time to process the bio chain, and the ns_segctor_sem lock remains held for a long period. This prevents other tasks from acquiring the ns_segctor_sem lock, resulting in the hang reported by syzbot in [1]. If the ending block is too small, typically if it is smaller than 4KiB range, depending on the usage of the segment 0, it may be possible to attempt a discard request beyond the device size causing the hang. Exiting successfully and assign the discarded size (0 in this case) to range->len. Although the start and len values in the user input range are too small, a conservative strategy is adopted here to safely ignore them, which is equivalent to a no-op; it will not perform any trimming and will not throw an error. [1] task:segctord state:D stack:28968 pid:6093 tgid:6093 ppid:2 task_flags:0x200040 flags:0x00080000 Call Trace: rwbase_write_lock+0x3dd/0x750 kernel/locking/rwbase_rt.c:272 nilfs_transaction_lock+0x253/0x4c0 fs/nilfs2/segment.c:357 nilfs_segctor_thread_construct fs/nilfs2/segment.c:2569 [inline] nilfs_segctor_thread+0x6ec/0xe00 fs/nilfs2/segment.c:2684 [ryusuke: corrected part of the commit message about the consequences]
Title		nilfs2: Fix potential block overflow that cause system hang
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4aa45f841413cca81882602b4042c53502f34cad https://git.kernel.org/stable/c/b8c5ee234bd54f1447c846101fdaef2cf70c2149 https://git.kernel.org/stable/c/df1e20796c9f3d541cca47fb72e4369ea135642d https://git.kernel.org/stable/c/ea2278657ad0d62596589fbe2caf995e189e65e7

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-02-18T14:53:22.436Z

Updated: 2026-04-13T06:02:26.549Z

Reserved: 2026-02-18T14:25:13.845Z

Link: CVE-2025-71237

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-02-18T16:22:30.517

Modified: 2026-03-18T14:58:45.933

Link: CVE-2025-71237

Redhat

Severity :

Publid Date: 2026-02-18T00:00:00Z

Links: CVE-2025-71237 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-20T21:00:12Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object