CVE-2025-71117

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

block: Remove queue freezing from several sysfs store callbacks

Freezing the request queue from inside sysfs store callbacks may cause a

deadlock in combination with the dm-multipath driver and the

queue_if_no_path option. Additionally, freezing the request queue slows

down system boot on systems where sysfs attributes are set synchronously.

Fix this by removing the blk_mq_freeze_queue() / blk_mq_unfreeze_queue()

calls from the store callbacks that do not strictly need these callbacks.

Add the __data_racy annotation to request_queue.rq_timeout to suppress

KCSAN data race reports about the rq_timeout reads.

This patch may cause a small delay in applying the new settings.

For all the attributes affected by this patch, I/O will complete

correctly whether the old or the new value of the attribute is used.

This patch affects the following sysfs attributes:

* io_poll_delay

* io_timeout

* nomerges

* read_ahead_kb

* rq_a

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References