PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-71128 Linux CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-01-14T15:16:02.547Z and has not been modified since then. The NVD entry is currently Modified. The Linux kernel vulnerability CVE-2025-71128 involves a buffer overflow issue in the erspan code. The problem arises from the incorrect handling of the options_len field in the struct ip_tunnel_info, which has a flexible array member named options. When the kernel is compiled with GCC 15+ and FORTIFY_SOURCE configured, this could lead to a kernel panic when handling ERSPAN traffic in GRE tunnels. The fix involves initializing options_len before referencing the options array. Linux kernel users and administrators, particularly those using kernel versions 6.15.1 up to but not including 6.18.4, or various 6.19 release candidates, should be aware of this vulnerability and take steps to patch their systems. This vulnerability has a high CVSS score of 7.5 and is classified as HIGH severity. Linux kernel users should prioritize patching. The Linux kernel vulnerability CVE-2025-71128 was resolved by initializing the options_len field before referencing the options array in the erspan code. This fix addresses a buffer overflow issue that could cause a kernel panic when handling ERSPAN traffic in GRE tunnels, particularly when compiled with GCC 15+ and FORTIFY_SOURCE enabled. Affected kernel versions include 6.15.1 up to but not including 6.18.4, as well as various 6.19 release candidates.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-14
Original CVE updated
2026-07-30
Advisory published
2026-01-14
Advisory updated
2026-07-30

Who should care

Linux kernel users and administrators, particularly those using kernel versions 6.15.1 up to but not including 6.18.4, or various 6.19 release candidates, should be aware of this vulnerability and take steps to patch their systems.

Technical summary

The Linux kernel vulnerability CVE-2025-71128 involves a buffer overflow issue in the erspan code. The problem arises from the incorrect handling of the options_len field in the struct ip_tunnel_info, which has a flexible array member named options. When the kernel is compiled with GCC 15+ and FORTIFY_SOURCE configured, this could lead to a kernel panic when handling ERSPAN traffic in GRE tunnels. The fix involves initializing options_len before referencing the options array.

Defensive priority

This vulnerability has a high CVSS score of 7.5 and is classified as HIGH severity. Linux kernel users should prioritize patching.

Recommended defensive actions

  • Apply patches from Linux kernel stable branches
  • Update Linux kernel to version 6.18.4 or later
  • Use ip_tunnel_info_opts_set() helper for GRE ERSPAN updates
  • Verify and update Linux kernel versions 6.15.1 and above
  • Monitor for unusual GRE tunnel activity

Evidence notes

The Linux kernel vulnerability CVE-2025-71128 was resolved by initializing the options_len field before referencing the options array in the erspan code. This fix addresses a buffer overflow issue that could cause a kernel panic when handling ERSPAN traffic in GRE tunnels, particularly when compiled with GCC 15+ and FORTIFY_SOURCE enabled. Affected kernel versions include 6.15.1 up to but not including 6.18.4, as well as various 6.19 release candidates.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-71128 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-71128

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-71128 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-71128

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/35ddf66c65eff93fff91406756ba273600bf61a3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b282b2a9eed848587c1348abdd5d83fa346a2743

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.