CVE-2025-71096 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, system administrators responsible for Linux systems with RDMA functionality enabled, and security teams should be aware of this vulnerability. They should review and apply the provided patches to the Linux kernel, ensure RDMA functionality is properly configured and monitored, and consider implementing compensating controls for systems that cannot be immediately patched.

Why it matters

CVE-2025-71096 is a medium-severity vulnerability in the Linux kernel's RDMA/core that could lead to information disclosure if exploited. It requires patching and verification of affected systems.

• Potential information disclosure due to uninitialized stack read.
• Requires verification of affected versions and application of patches.
• Defensive priority for systems using RDMA functionality in the Linux kernel.

Technical summary

The Linux kernel's RDMA/core did not properly check for the presence of LS_NLA_TYPE_DGID in the netlink response for RDMA_NL_LS_OP_IP_RESOLVE, leading to an uninitialized read from the stack. This has been fixed by properly parsing the netlink attributes. The vulnerability was introduced due to improper handling of the LS_NLA_TYPE_DGID attribute in the netlink response for RDMA_NL_LS_OP_IP_RESOLVE. The fix involves using proper nl parsing logic and directly indexing the nlattrs array to get the DGID data. This issue could potentially lead to information disclosure if exploited.

Defensive priority

Medium priority for systems using the affected Linux kernel versions, especially those with RDMA functionality enabled.

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel.
• Ensure RDMA functionality is properly configured and monitored.
• Consider implementing compensating controls for systems that cannot be immediately patched.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The vulnerability was introduced due to improper handling of the LS_NLA_TYPE_DGID attribute in the netlink response for RDMA_NL_LS_OP_IP_RESOLVE. The fix involves using proper nl parsing logic and directly indexing the nlattrs array to get the DGID data.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.