CVE-2025-71106 fs: PM: Fix reverse check in filesystems_freeze_callback()
A logic error in the Linux kernel's filesystem freeze callback causes unintended freezing of all filesystems, potentially triggering warnings and system instability.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-71106?
CVE-2025-71106 is a medium-severity denial of service vulnerability in Linux kernel, published on 14 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
fs: PM: Fix reverse check in filesystems_freeze_callback()
The freeze_all_ptr check in filesystems_freeze_callback() introduced by commit a3f8f8662771 ("power: always freeze efivarfs") is reverse which quite confusingly causes all file systems to be frozen when filesystem_freeze_enabled is false.
On my systems it causes the WARN_ON_ONCE() in __set_task_frozen() to trigger, most likely due to an attempt to freeze a file system that is not ready for that.
Add a logical negation to the check in question to reverse it as appropriate.
Which versions are affected by CVE-2025-71106?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-71106?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-71106 being exploited?
There is no known exploitation of CVE-2025-71106 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-71106, GHSA-65w6-rwf9-587r, UBUNTU-CVE-2025-71106.