CVE-2025-71080: ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix a BUG in rt6getpcpuroute() under PREEMPTRT
On PREEMPTRT kernels, after rt6getpcpuroute() returns NULL, the current task can be preempted. Another task running on the same CPU may then execute rt6makepcpuroute() and successfully install a pcpurt entry. When the first task resumes execution, its cmpxchg() in rt6makepcpuroute() will fail because rt6ipcpu is no longer NULL, triggering the BUGON(prev). It's easy to reproduce it by adding mdelay() after rt6getpcpuroute().
Using preemptdisable/enable is not appropriate here because ip6rtpcpualloc() may sleep.
Fix this by handling the cmpxchg() failure gracefully on PREEMPTRT: free our allocation and return the existing pcpurt installed by another task. The BUGON is replaced by WARNONONCE for non-PREEMPTRT kernels where such races should not occur.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71080?
CVE-2025-71080 is categorized as a moderate severity vulnerability due to potential preemption issues in the Linux kernel.
How do I fix CVE-2025-71080?
To fix CVE-2025-71080, update your Linux kernel to a version that includes the patch addressing the bug in rt6_get_pcpu_route().
What systems are affected by CVE-2025-71080?
CVE-2025-71080 affects Linux kernel versions that are running under PREEMPT_RT configuration.
What happens if CVE-2025-71080 is exploited?
If exploited, CVE-2025-71080 can potentially lead to a denial of service due to task preemption issues.
When was CVE-2025-71080 reported?
CVE-2025-71080 was reported and addressed in the Linux kernel prior to its public disclosure.