The Linux kernel block layer had a vulnerability where freezing the request queue inside sysfs store callbacks could cause a deadlock in combination with the dm-multipath driver and the queue_if_no_path option. Additionally, freezing the request queue slowed down system boot on systems where sysfs attributes are set synchronously. The fix involved removing blk_mq_freeze_queue() and blk_mq_unfreeze_queue() calls from store callbacks that do not strictly require them. The patch also added the __data_racy annotation to request_queue.rq_timeout to suppress KCSAN data race reports. This update affects multiple sysfs attributes such as io_poll_delay, io_timeout, nomerges, read_ahead_kb, and rq_affinity. The patch ensures I/O completes correctly whether the old or new attribute values are used. The vulnerability is tracked as CVE-2025-71117 with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), indicating local attacker with low privileges can cause denial of service via availability impact. The vendor advisory from Ubuntu confirms the availability of a patch and recommends updating to kernel versions 6.17.0-22.22 or later.

This vulnerability can cause a deadlock in the Linux kernel block layer subsystem when used with the dm-multipath driver and the queue_if_no_path option, resulting in denial of service (availability impact). It also slows down system boot on systems that set sysfs attributes synchronously. There is no impact on confidentiality or integrity. The vulnerability requires local privileges and low attack complexity.

A patch is available and has been released in Linux kernel versions 6.17.0-22.22 and later. Users should update their Linux kernel to these versions or newer to remediate the issue. After updating, a system reboot is required to apply the fix. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. Follow vendor instructions for updating and rebuilding kernel modules as needed.