CVE-2025-71095: net: stmmac: fix the crash issue for zero copy XDP_TX action

Published Jan 13, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

net: stmmac: fix the crash issue for zero copy XDPTX action

There is a crash issue when running zero copy XDPTX action, the crash log is shown below.

[ 216.122464] Unable to handle kernel paging request at virtual address fffeffff80000000 [ 216.187524] Internal error: Oops: 0000000096000144 [#1] SMP [ 216.301694] Call trace: [ 216.304130] dcachecleanpoc+0x20/0x38 (P) [ 216.308308] dmasyncsinglefordevice+0x1bc/0x1e0 [ 216.313351] stmmacxdpxmitxdpf+0x354/0x400 [ 216.317701] stmmacxdprunprog+0x164/0x368 [ 216.322139] stmmacnapipollrxtx+0xba8/0xf00 [ 216.326576] napipoll+0x40/0x218 [ 216.408054] Kernel panic - not syncing: Oops: Fatal exception in interrupt

For XDPTX action, the xdpbuff is converted to xdpframe by xdpconvertbufftoframe(). The memory type of the resulting xdpframe depends on the memory type of the xdpbuff. For page pool based xdpbuff it produces xdpframe with memory type MEMTYPEPAGEPOOL. For zero copy XSK pool based xdpbuff it produces xdpframe with memory type MEMTYPEPAGEORDER0. However, stmmacxdpxmitback() does not check the memory type and always uses the page pool type, this leads to invalid mappings and causes the crash. Therefore, check the xdpbuff memory type in stmmacxdpxmitback() to fix this issue.

Affected Software

15 affected componentsFixes available
Linux Linux kernel
Linux Linux kernel>=5.13.1<6.1.160
Linux Linux kernel>=6.2<6.6.120
Linux Linux kernel>=6.7<6.12.64
Linux Linux kernel>=6.13<6.18.4
Linux Linux kernel=5.13
Linux Linux kernel=6.19-rc1
Linux Linux kernel=6.19-rc2
Linux Linux kernel=6.19-rc3
Linux Linux kernel=6.19-rc4
Linux Linux kernel=6.19-rc5
Linux Linux kernel=6.19-rc6
Linux Linux kernel=6.19-rc7
Linux Linux kernel=6.19-rc8
Microsoft azl3 kernel 6.6.119.3-3<6.6.121.1-1
6.6.121.1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 6.6.121.1-1
  2. Configuration

    Update stmmac XDP_TX zero-copy transmit path so stmmac_xdp_xmit_back() checks the xdp_buff memory type and handles page-pool/xsk pool cases correctly instead of always relying on MEM_TYPE_PAGE_POOL.

    Linux kernel networking (stmmac) xdp_convert_buff_to_frame() / stmmac_xdp_xmit_back() memory-type checking for zero-copy XDP_TX = Enable/check xdp_buff memory type before producing xdp_frame

Event History

Jan 13, 2026
CVE Published
via MITRE·03:34 PM
Data Sourced
via MITRE·03:34 PM
DescriptionSeverity
Data Sourced
via NVD·04:16 PM
RemedyDescriptionSeverityAffected Software
Jan 15, 2026
Data Sourced
via Microsoft·09:01 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·09:01 AM
Affected Software
Updated
via Microsoft·09:01 AM
DescriptionSeverity

Frequently Asked Questions

1

What is the severity of CVE-2025-71095?

CVE-2025-71095 has been classified as a medium severity vulnerability due to the potential for system crashes.

2

How do I fix CVE-2025-71095?

To address CVE-2025-71095, you should upgrade your Linux kernel to the latest stable version that includes the fix for the zero copy XDP_TX action crash.

3

What components are affected by CVE-2025-71095?

CVE-2025-71095 affects the networking component of the Linux kernel, specifically the stmmac driver.

4

Can CVE-2025-71095 be exploited remotely?

Yes, CVE-2025-71095 can potentially be exploited remotely if the zero copy XDP_TX action is used in an exposed environment.

5

What is the nature of the crash in CVE-2025-71095?

The crash associated with CVE-2025-71095 occurs when the zero copy XDP_TX action is executed, leading to a failure in the system.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203