CVE-2025-71080 Linux CVE debrief

Who should care

Users of Linux kernel versions 6.12.1 to 6.12.64, 6.13 to 6.18.4, and 6.19 rc1 to rc8 should apply patches to prevent potential exploitation. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure that affected Linux kernel versions are patched or mitigated. Review and update Linux kernel versions to ensure affected versions are patched, and monitor for potential exploitation attempts. Additionally, consider compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions and retest remediated assets to close the item only after evidence is documented. Asset inventory management is crucial to identify potentially affected systems. Regularly review relevant monitoring, detection, and logs for exposed assets that need extra review. Planning vendor-supported updates or mitigations through normal change control where exposure is confirmed is also essential. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. This comprehensive approach ensures that all stakeholders take necessary actions to mitigate the vulnerability effectively. It is also important to check for any additional vendor guidance or advisories that may impact the patching process or provide further mitigation strategies. By taking these steps, organizations can reduce the risk associated with this vulnerability and protect their systems from potential exploitation. Furthermore, maintaining an up-to-date inventory of assets and regularly reviewing system configurations can help in identifying and addressing potential vulnerabilities before they can be exploited. This proactive approach to vulnerability management is critical in maintaining the security and integrity of systems and data. Therefore, it is imperative that all relevant stakeholders take immediate action to address this vulnerability and ensure the security of their systems. This includes not only applying patches but also reviewing and updating internal processes and procedures to prevent similar vulnerabilities from being exploited in the future. By doing so, organizations can

Technical summary

The vulnerability is caused by a race condition in the rt6_get_pcpu_route() function under PREEMPT_RT kernels. This issue arises when rt6_get_pcpu_route() returns NULL, allowing the current task to be preempted. Another task on the same CPU may then execute rt6_make_pcpu_route(), installing a pcpu_rt entry. Upon resumption, the first task's cmpxchg() in rt6_make_pcpu_route() fails due to rt6i_pcpu being non-NULL, triggering a BUG_ON(prev). The fix involves handling cmpxchg() failure gracefully on PREEMPT_RT kernels by freeing the allocation and returning the existing pcpu_rt installed by another task. For non-PREEMPT_RT kernels, the BUG_ON is replaced with WARN_ON_ONCE, as such races should not occur. Users should apply patches from Linux kernel stable branches to resolve this issue.

Defensive priority

High

Recommended defensive actions

• Apply patches from Linux kernel stable branches
• Review and update Linux kernel versions to ensure affected versions are patched
• Monitor for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was resolved by handling the cmpxchg() failure gracefully on PREEMPT_RT kernels, freeing the allocation and returning the existing pcpu_rt installed by another task. The BUG_ON is replaced by WARN_ON_ONCE for non-PREEMPT_RT kernels.

Official resources