PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-71128 Linux CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-01-14T15:16:02.547Z and has not been modified since then. The NVD entry is currently Modified. The Linux kernel vulnerability CVE-2025-71128 involves a buffer overflow issue in the erspan code. The problem arises from the incorrect handling of the options_len field in the struct ip_tunnel_info, which has a flexible array member named options. When the kernel is compiled with GCC 15+ and FORTIFY_SOURCE configured, this could lead to a kernel panic when handling ERSPAN traffic in GRE tunnels. The fix involves initializing options_len before referencing the options array. Linux kernel users and administrators, particularly those using kernel versions 6.15.1 up to but not including 6.18.4, or various 6.19 release candidates, should be aware of this vulnerability and take steps to patch their systems. This vulnerability has a high CVSS score of 7.5 and is classified as HIGH severity. Linux kernel users should prioritize patching. The Linux kernel vulnerability CVE-2025-71128 was resolved by initializing the options_len field before referencing the options array in the erspan code. This fix addresses a buffer overflow issue that could cause a kernel panic when handling ERSPAN traffic in GRE tunnels, particularly when compiled with GCC 15+ and FORTIFY_SOURCE enabled. Affected kernel versions include 6.15.1 up to but not including 6.18.4, as well as various 6.19 release candidates.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-01-14
Original CVE updated
2026-07-30
Advisory published
2026-01-14
Advisory updated
2026-07-30

Who should care

Linux kernel users and administrators, particularly those using kernel versions 6.15.1 up to but not including 6.18.4, or various 6.19 release candidates, should be aware of this vulnerability and take steps to patch their systems.

Technical summary

The Linux kernel vulnerability CVE-2025-71128 involves a buffer overflow issue in the erspan code. The problem arises from the incorrect handling of the options_len field in the struct ip_tunnel_info, which has a flexible array member named options. When the kernel is compiled with GCC 15+ and FORTIFY_SOURCE configured, this could lead to a kernel panic when handling ERSPAN traffic in GRE tunnels. The fix involves initializing options_len before referencing the options array.

Defensive priority

This vulnerability has a high CVSS score of 7.5 and is classified as HIGH severity. Linux kernel users should prioritize patching.

Recommended defensive actions

  • Apply patches from Linux kernel stable branches
  • Update Linux kernel to version 6.18.4 or later
  • Use ip_tunnel_info_opts_set() helper for GRE ERSPAN updates
  • Verify and update Linux kernel versions 6.15.1 and above
  • Monitor for unusual GRE tunnel activity

Evidence notes

The Linux kernel vulnerability CVE-2025-71128 was resolved by initializing the options_len field before referencing the options array in the erspan code. This fix addresses a buffer overflow issue that could cause a kernel panic when handling ERSPAN traffic in GRE tunnels, particularly when compiled with GCC 15+ and FORTIFY_SOURCE enabled. Affected kernel versions include 6.15.1 up to but not including 6.18.4, as well as various 6.19 release candidates.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-01-14T15:16:02.547Z and has not been modified since then.