CVE-2025-71097 Linux CVE debrief

Who should care

System administrators and security teams managing Linux-based systems, especially those using IPv4 and nexthop objects, should be aware of this vulnerability. They should assess their systems for exposure and apply mitigations or patches as necessary.

Technical summary

The Linux kernel's IPv4 stack has a vulnerability (CVE-2025-71097) that causes a reference count leak when error routes are used with nexthop objects. Normally, when a nexthop object is deleted, it is marked as dead, and fib_table_flush() is called to remove all routes using the dead nexthop. However, the current logic only flushes error routes when network namespace dismantle occurs (with flush_all=true). Consequently, error routes persist, holding references to the nexthop object and its device, preventing proper cleanup.

Defensive priority

Medium priority due to the potential for denial-of-service (DoS) conditions through interface removal delays or network instability.

Recommended defensive actions

• Apply the official patches provided by the Linux kernel maintainers.
• Inventory Linux systems for exposure, focusing on those using IPv4 and nexthop objects.
• Monitor for signs of interface removal issues or reference count leaks.
• Consider implementing compensating controls such as limiting the lifetime of nexthop objects or enhancing logging for reference count changes.
• Perform a thorough review of network configurations to identify potential exposure.
• Implement additional monitoring to detect anomalies in network behavior.
• Review and update incident response plans to address potential impacts of this vulnerability.

Evidence notes

The vulnerability was resolved through a series of patches applied to the Linux kernel's stable branches. Multiple commits addressed this issue by ensuring error routes are properly flushed when their nexthop object is marked as dead.

Official resources