CVE-2025-71285 Linux CVE debrief

Who should care

Linux kernel maintainers, users, and administrators, especially those using affected versions (5.15.63 to 5.16, 5.17 to 6.18.17, and 6.19 to 6.19.6), should assess exposure and apply patches or updates as needed to prevent potential NULL pointer dereferences and system instability. This includes verifying Linux kernel versions, reviewing compensating controls, and monitoring for potential future vulnerabilities.

Why it matters

CVE-2025-71285 is a medium-severity vulnerability in the Linux kernel's net: qrtr module. Linux kernel maintainers and users should assess exposure, especially for versions 5.15.63 to 5.16, 5.17 to 6.18.17, and 6.19 to 6.19.6, and apply patches or updates as needed to prevent potential NULL pointer dereferences and system instability.

• Potential NULL pointer dereferences in Linux kernel versions 5.15.63 to 5.16, 5.17 to 6.18.17, and 6.19 to 6.19.6.
• Race conditions between client drivers and the MHI stack could lead to system instability.
• Verification of Linux kernel versions and application of patches is necessary to prevent potential issues.

Technical summary

The Linux kernel's net: qrtr module had a vulnerability due to the MHI auto_queue feature for IPCR DL channels. This feature has been dropped to prevent potential NULL pointer dereferences. Affected versions include 5.15.63 to 5.16, 5.17 to 6.18.17, and 6.19 to 6.19.6. The fix involves managing RX buffers manually in the QRTR driver, queuing them based on ring length during probe, and recycling them in 'dl_callback' once consumed. Linux kernel maintainers and users should assess exposure and apply patches or updates as needed.

Defensive priority

Medium priority for Linux kernel maintainers and users, especially those using versions 5.15.63 to 5.16, 5.17 to 6.18.17, and 6.19 to 6.19.6.

Recommended defensive actions

• Review and apply patches from Linux kernel maintainers for affected versions.
• Update Linux kernel to versions outside the vulnerable ranges (e.g., 5.15.0-67-generic, 5.16.0-67-generic, 6.18.18-20-generic).
• Monitor Linux kernel updates for potential future vulnerabilities.
• Verify Linux kernel versions and apply patches or updates as needed to prevent potential NULL pointer dereferences and system instability.
• Perform compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, including its description, CVSS score, and affected versions. Multiple patch references are available. The Linux kernel maintainers have addressed this issue by dropping the MHI auto_queue feature for IPCR DL channels. The fix is available in Linux kernel versions outside the vulnerable ranges. Users should verify their kernel versions and apply patches or updates as needed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.