{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-71237", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-02-18T14:25:13.845Z", "datePublished": "2026-02-18T14:53:22.436Z", "dateUpdated": "2026-05-11T21:56:59.574Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:56:59.574Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: Fix potential block overflow that cause system hang\n\nWhen a user executes the FITRIM command, an underflow can occur when\ncalculating nblocks if end_block is too small. Since nblocks is of\ntype sector_t, which is u64, a negative nblocks value will become a\nvery large positive integer. This ultimately leads to the block layer\nfunction __blkdev_issue_discard() taking an excessively long time to\nprocess the bio chain, and the ns_segctor_sem lock remains held for a\nlong period. This prevents other tasks from acquiring the ns_segctor_sem\nlock, resulting in the hang reported by syzbot in [1].\n\nIf the ending block is too small, typically if it is smaller than 4KiB\nrange, depending on the usage of the segment 0, it may be possible to\nattempt a discard request beyond the device size causing the hang.\n\nExiting successfully and assign the discarded size (0 in this case)\nto range->len.\n\nAlthough the start and len values in the user input range are too small,\na conservative strategy is adopted here to safely ignore them, which is\nequivalent to a no-op; it will not perform any trimming and will not\nthrow an error.\n\n[1]\ntask:segctord state:D stack:28968 pid:6093 tgid:6093 ppid:2 task_flags:0x200040 flags:0x00080000\nCall Trace:\n rwbase_write_lock+0x3dd/0x750 kernel/locking/rwbase_rt.c:272\n nilfs_transaction_lock+0x253/0x4c0 fs/nilfs2/segment.c:357\n nilfs_segctor_thread_construct fs/nilfs2/segment.c:2569 [inline]\n nilfs_segctor_thread+0x6ec/0xe00 fs/nilfs2/segment.c:2684\n\n[ryusuke: corrected part of the commit message about the consequences]"}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nilfs2/sufile.c"], "versions": [{"version": "82e11e857be3ffd2a0a952c9db8aa2379e2b9e44", "lessThan": "6457d3ee41a4c15082ac49c5aa7fb933b4a043f3", "status": "affected", "versionType": "git"}, {"version": "82e11e857be3ffd2a0a952c9db8aa2379e2b9e44", "lessThan": "ba18e5f22f26aa4ef78bc3e81f639d1d4f3845e6", "status": "affected", "versionType": "git"}, {"version": "82e11e857be3ffd2a0a952c9db8aa2379e2b9e44", "lessThan": "2438982f635e6cc2009be68ba2efb2998727d8d4", "status": "affected", "versionType": "git"}, {"version": "82e11e857be3ffd2a0a952c9db8aa2379e2b9e44", "lessThan": "df1e20796c9f3d541cca47fb72e4369ea135642d", "status": "affected", "versionType": "git"}, {"version": "82e11e857be3ffd2a0a952c9db8aa2379e2b9e44", "lessThan": "ea2278657ad0d62596589fbe2caf995e189e65e7", "status": "affected", "versionType": "git"}, {"version": "82e11e857be3ffd2a0a952c9db8aa2379e2b9e44", "lessThan": "4aa45f841413cca81882602b4042c53502f34cad", "status": "affected", "versionType": "git"}, {"version": "82e11e857be3ffd2a0a952c9db8aa2379e2b9e44", "lessThan": "b8c5ee234bd54f1447c846101fdaef2cf70c2149", "status": "affected", "versionType": "git"}, {"version": "82e11e857be3ffd2a0a952c9db8aa2379e2b9e44", "lessThan": "ed527ef0c264e4bed6c7b2a158ddf516b17f5f66", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/nilfs2/sufile.c"], "versions": [{"version": "3.15", "status": "affected"}, {"version": "0", "lessThan": "3.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.251", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.201", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.164", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.125", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.72", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.11", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.1", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "5.10.251"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "5.15.201"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.1.164"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.6.125"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.12.72"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.18.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.19.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/6457d3ee41a4c15082ac49c5aa7fb933b4a043f3"}, {"url": "https://git.kernel.org/stable/c/ba18e5f22f26aa4ef78bc3e81f639d1d4f3845e6"}, {"url": "https://git.kernel.org/stable/c/2438982f635e6cc2009be68ba2efb2998727d8d4"}, {"url": "https://git.kernel.org/stable/c/df1e20796c9f3d541cca47fb72e4369ea135642d"}, {"url": "https://git.kernel.org/stable/c/ea2278657ad0d62596589fbe2caf995e189e65e7"}, {"url": "https://git.kernel.org/stable/c/4aa45f841413cca81882602b4042c53502f34cad"}, {"url": "https://git.kernel.org/stable/c/b8c5ee234bd54f1447c846101fdaef2cf70c2149"}, {"url": "https://git.kernel.org/stable/c/ed527ef0c264e4bed6c7b2a158ddf516b17f5f66"}], "title": "nilfs2: Fix potential block overflow that cause system hang", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7BF232A2-85DC-4F39-B61B-5D73152A23C0", "versionEndExcluding": "5.10.251", "versionStartIncluding": "3.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "600A89ED-86F2-48D8-BB7C-5EE7A8832FC5", "versionEndExcluding": "5.15.201", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6892F74B-3F14-4500-9652-24A2ECB04144", "versionEndExcluding": "6.1.164", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "74B70CDE-7B74-4280-BBCC-8889B8F28466", "versionEndExcluding": "6.6.125", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F1A7E514-FB3C-4B6B-8046-07D5A8F04644", "versionEndExcluding": "6.12.72", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7099A9EC-3D54-4424-BF01-7224EF88C79C", "versionEndExcluding": "6.18.11", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "EE543C0D-A06B-414F-A403-CB1E088F261E", "versionEndExcluding": "6.19.1", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: Fix potential block overflow that cause system hang\n\nWhen a user executes the FITRIM command, an underflow can occur when\ncalculating nblocks if end_block is too small. Since nblocks is of\ntype sector_t, which is u64, a negative nblocks value will become a\nvery large positive integer. This ultimately leads to the block layer\nfunction __blkdev_issue_discard() taking an excessively long time to\nprocess the bio chain, and the ns_segctor_sem lock remains held for a\nlong period. This prevents other tasks from acquiring the ns_segctor_sem\nlock, resulting in the hang reported by syzbot in [1].\n\nIf the ending block is too small, typically if it is smaller than 4KiB\nrange, depending on the usage of the segment 0, it may be possible to\nattempt a discard request beyond the device size causing the hang.\n\nExiting successfully and assign the discarded size (0 in this case)\nto range->len.\n\nAlthough the start and len values in the user input range are too small,\na conservative strategy is adopted here to safely ignore them, which is\nequivalent to a no-op; it will not perform any trimming and will not\nthrow an error.\n\n[1]\ntask:segctord state:D stack:28968 pid:6093 tgid:6093 ppid:2 task_flags:0x200040 flags:0x00080000\nCall Trace:\n rwbase_write_lock+0x3dd/0x750 kernel/locking/rwbase_rt.c:272\n nilfs_transaction_lock+0x253/0x4c0 fs/nilfs2/segment.c:357\n nilfs_segctor_thread_construct fs/nilfs2/segment.c:2569 [inline]\n nilfs_segctor_thread+0x6ec/0xe00 fs/nilfs2/segment.c:2684\n\n[ryusuke: corrected part of the commit message about the consequences]"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnilfs2: Corrige un posible desbordamiento de bloque que causa un cuelgue del sistema\n\nCuando un usuario ejecuta el comando FITRIM, puede ocurrir un subdesbordamiento al calcular nblocks si end_block es demasiado peque\u00f1o. Dado que nblocks es de tipo sector_t, que es u64, un valor negativo de nblocks se convertir\u00e1 en un entero positivo muy grande. Esto finalmente lleva a que la funci\u00f3n de la capa de bloques __blkdev_issue_discard() tarde un tiempo excesivamente largo en procesar la cadena bio, y el bloqueo ns_segctor_sem permanezca retenido durante un largo per\u00edodo. Esto impide que otras tareas adquieran el bloqueo ns_segctor_sem, lo que resulta en el cuelgue reportado por syzbot en [1].\n\nSi el bloque final es demasiado peque\u00f1o, t\u00edpicamente si es menor que el rango de 4KiB, dependiendo del uso del segmento 0, puede ser posible intentar una solicitud de descarte m\u00e1s all\u00e1 del tama\u00f1o del dispositivo, causando el cuelgue.\n\nSaliendo con \u00e9xito y asignando el tama\u00f1o descartado (0 en este caso) a range->len.\n\nAunque los valores de inicio y longitud en el rango de entrada del usuario son demasiado peque\u00f1os, se adopta aqu\u00ed una estrategia conservadora para ignorarlos de forma segura, lo cual es equivalente a una no-op; no realizar\u00e1 ning\u00fan recorte y no lanzar\u00e1 un error.\n\n[1]\ntarea:segctord estado:D pila:28968 pid:6093 tgid:6093 ppid:2 flags_de_tarea:0x200040 flags:0x00080000\nTraza de Llamada:\n rwbase_write_lock+0x3dd/0x750 kernel/locking/rwbase_rt.c:272\n nilfs_transaction_lock+0x253/0x4c0 fs/nilfs2/segment.c:357\n nilfs_segctor_thread_construct fs/nilfs2/segment.c:2569 [inline]\n nilfs_segctor_thread+0x6ec/0xe00 fs/nilfs2/segment.c:2684\n\n[ryusuke: corregida parte del mensaje de commit sobre las consecuencias]"}], "id": "CVE-2025-71237", "lastModified": "2026-03-18T14:58:45.933", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-02-18T16:22:30.517", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2438982f635e6cc2009be68ba2efb2998727d8d4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4aa45f841413cca81882602b4042c53502f34cad"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/6457d3ee41a4c15082ac49c5aa7fb933b4a043f3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b8c5ee234bd54f1447c846101fdaef2cf70c2149"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ba18e5f22f26aa4ef78bc3e81f639d1d4f3845e6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/df1e20796c9f3d541cca47fb72e4369ea135642d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ea2278657ad0d62596589fbe2caf995e189e65e7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ed527ef0c264e4bed6c7b2a158ddf516b17f5f66"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: nilfs2: Fix potential block overflow that cause system hang", "id": "2440671", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2440671"}, "csaw": false, "details": ["No description is available for this CVE."], "name": "CVE-2025-71237", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-71237\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-71237\nhttps://lore.kernel.org/linux-cve-announce/2026021806-CVE-2025-71237-545a@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,df1e20796c9f3d541cca47fb72e4369ea135642d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,ea2278657ad0d62596589fbe2caf995e189e65e7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4aa45f841413cca81882602b4042c53502f34cad)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b8c5ee234bd54f1447c846101fdaef2cf70c2149)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.125,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.72,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.11,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.1,6.20.0)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-20T20:51:48.793801+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a version that contains the nilfs2 block overflow fix (commit 2438982f6 and related patches).", "If an immediate kernel update is not possible, avoid using the FITRIM command on nilfs2 filesystems; instead use alternative data-correction methods that do not trigger discard.", "For systems that must perform trims, ensure that the end block argument is validated to be at least a page (4 KiB) or higher before invoking FITRIM, or use a wrapper that suppresses small values."], "summary": {"action": "Apply Patch", "impact": "Denial of Service (system hang)"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all releases of the Linux kernel that include the nilfs2 filesystem implementation, with no specific version range provided. Any system running Linux that mounts a nilfs2 filesystem and permits FITRIM operations is susceptible.", "description_and_impact": "An overflow in the nilfs2 filesystem occurs when the FITRIM command calculates the number of blocks to discard. If the supplied end block is too small, the unsigned sector_t calculation underflows, turning a negative number into a very large positive value. This causes the kernel\u2019s block layer to issue an excessively large discard request, holding a semaphore for an extended period and preventing other tasks from progressing. The result is a system hang, as observed by the syzbot test harness. The weakness is a signed to unsigned conversion error (CWE\u2011193).", "risk_and_exploitability": "The CVSS score of 5.5 reflects a moderate impact, and the EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not listed in CISA\u2019s KEV catalog. It is inferred that attackers would need local or privileged access to issue a FITRIM command on a nilfs2 filesystem; the flaw is thus a local denial-of-service threat that would affect system availability by preventing other processes from acquiring a key mutex lock."}}}}, "created": "2026-02-19T10:11:51.826529+00:00", "updated": "2026-04-20T21:00:12.957558+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-193"]}