Executive brief
A vulnerability in the Linux kernel's dm-verity component can allow a local user to cause a system hang or denial-of-service. dm-verity is a tool used to ensure the integrity of disk partitions, often used in Android and other secure Linux distributions. By providing a specially crafted disk image, an attacker can trigger an infinite loop that freezes system processes, potentially disrupting operations or requiring a hard reboot.
Technical details
A vulnerability exists in the dm-verity Forward Error Correction (FEC) implementation where recursive calls in 'fec_read_bufs' can lead to a denial-of-service. The 'verity_hash_for_block' function could be called recursively up to a limit of 4 nested levels, which, combined with a loop of 253 iterations, could result in over 4 billion iterations. This computational exhaustion causes affected processes (such as udev-worker) to enter an uninterruptible sleep ('D' state). Additionally, the shared 'fio->bufs' variable between recursive invocations could lead to data corruption as recursive calls overwrite partially filled buffers. The fix disables recursive FEC by returning an error if the recursion level is greater than zero.
Affected products
- Linux Linux Kernel 4.5 to 6.18.6
Timeline
- 2025-11-14: other: Patch authored
- 2026-01-23: advisory: NVD Published Date
References
- https://git.kernel.org/stable/c/232948cf600fba69aff36b25d85ef91a73a35756
- https://git.kernel.org/stable/c/4220cb37406915c926c0e4a3dbab77cd9cceeb1e
- https://git.kernel.org/stable/c/897d9006e75f46f8bd7df78faa424327ae6a4bcf
- https://git.kernel.org/stable/c/8b821ca892cfeeaf0bedc9fc72717294f67144d5
- https://git.kernel.org/stable/c/d9f3e47d3fae0c101d9094bc956ed24e7a0ee801
- https://git.kernel.org/stable/c/e227d2b229c7529bd98d348efc55262ccf24ab35