{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-71237", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-02-18T14:25:13.845Z", "datePublished": "2026-02-18T14:53:22.436Z", "dateUpdated": "2026-05-11T21:56:59.574Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:56:59.574Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: Fix potential block overflow that cause system hang\n\nWhen a user executes the FITRIM command, an underflow can occur when\ncalculating nblocks if end_block is too small. Since nblocks is of\ntype sector_t, which is u64, a negative nblocks value will become a\nvery large positive integer. This ultimately leads to the block layer\nfunction __blkdev_issue_discard() taking an excessively long time to\nprocess the bio chain, and the ns_segctor_sem lock remains held for a\nlong period. This prevents other tasks from acquiring the ns_segctor_sem\nlock, resulting in the hang reported by syzbot in [1].\n\nIf the ending block is too small, typically if it is smaller than 4KiB\nrange, depending on the usage of the segment 0, it may be possible to\nattempt a discard request beyond the device size causing the hang.\n\nExiting successfully and assign the discarded size (0 in this case)\nto range->len.\n\nAlthough the start and len values in the user input range are too small,\na conservative strategy is adopted here to safely ignore them, which is\nequivalent to a no-op; it will not perform any trimming and will not\nthrow an error.\n\n[1]\ntask:segctord state:D stack:28968 pid:6093 tgid:6093 ppid:2 task_flags:0x200040 flags:0x00080000\nCall Trace:\n rwbase_write_lock+0x3dd/0x750 kernel/locking/rwbase_rt.c:272\n nilfs_transaction_lock+0x253/0x4c0 fs/nilfs2/segment.c:357\n nilfs_segctor_thread_construct fs/nilfs2/segment.c:2569 [inline]\n nilfs_segctor_thread+0x6ec/0xe00 fs/nilfs2/segment.c:2684\n\n[ryusuke: corrected part of the commit message about the consequences]" } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/nilfs2/sufile.c" ], "versions": [ { "version": "82e11e857be3ffd2a0a952c9db8aa2379e2b9e44", "lessThan": "6457d3ee41a4c15082ac49c5aa7fb933b4a043f3", "status": "affected", "versionType": "git" }, { "version": "82e11e857be3ffd2a0a952c9db8aa2379e2b9e44", "lessThan": "ba18e5f22f26aa4ef78bc3e81f639d1d4f3845e6", "status": "affected", "versionType": "git" }, { "version": "82e11e857be3ffd2a0a952c9db8aa2379e2b9e44", "lessThan": "2438982f635e6cc2009be68ba2efb2998727d8d4", "status": "affected", "versionType": "git" }, { "version": "82e11e857be3ffd2a0a952c9db8aa2379e2b9e44", "lessThan": "df1e20796c9f3d541cca47fb72e4369ea135642d", "status": "affected", "versionType": "git" }, { "version": "82e11e857be3ffd2a0a952c9db8aa2379e2b9e44", "lessThan": "ea2278657ad0d62596589fbe2caf995e189e65e7", "status": "affected", "versionType": "git" }, { "version": "82e11e857be3ffd2a0a952c9db8aa2379e2b9e44", "lessThan": "4aa45f841413cca81882602b4042c53502f34cad", "status": "affected", "versionType": "git" }, { "version": "82e11e857be3ffd2a0a952c9db8aa2379e2b9e44", "lessThan": "b8c5ee234bd54f1447c846101fdaef2cf70c2149", "status": "affected", "versionType": "git" }, { "version": "82e11e857be3ffd2a0a952c9db8aa2379e2b9e44", "lessThan": "ed527ef0c264e4bed6c7b2a158ddf516b17f5f66", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/nilfs2/sufile.c" ], "versions": [ { "version": "3.15", "status": "affected" }, { "version": "0", "lessThan": "3.15", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.251", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.201", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.164", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.125", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.72", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.11", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.1", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "5.10.251" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "5.15.201" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.1.164" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.6.125" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.12.72" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.18.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "6.19.1" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.15", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/6457d3ee41a4c15082ac49c5aa7fb933b4a043f3" }, { "url": "https://git.kernel.org/stable/c/ba18e5f22f26aa4ef78bc3e81f639d1d4f3845e6" }, { "url": "https://git.kernel.org/stable/c/2438982f635e6cc2009be68ba2efb2998727d8d4" }, { "url": "https://git.kernel.org/stable/c/df1e20796c9f3d541cca47fb72e4369ea135642d" }, { "url": "https://git.kernel.org/stable/c/ea2278657ad0d62596589fbe2caf995e189e65e7" }, { "url": "https://git.kernel.org/stable/c/4aa45f841413cca81882602b4042c53502f34cad" }, { "url": "https://git.kernel.org/stable/c/b8c5ee234bd54f1447c846101fdaef2cf70c2149" }, { "url": "https://git.kernel.org/stable/c/ed527ef0c264e4bed6c7b2a158ddf516b17f5f66" } ], "title": "nilfs2: Fix potential block overflow that cause system hang", "x_generator": { "engine": "bippy-1.2.0" } } } }