CVE-2025-71096: RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Check for the presence of LSNLATYPEDGID correctly
The netlink response for RDMANLLSOPIPRESOLVE should always have a LSNLATYPEDGID attribute, it is invalid if it does not.
Use the nl parsing logic properly and call nlaparsedeprecated() to fill the nlattrs array and then directly index that array to get the data for the DGID. Just fail if it is NULL.
Remove the for loop searching for the nla, and squash the validation and parsing into one function.
Fixes an uninitialized read from the stack triggered by userspace if it does not provide the DGID to a kernel initiated RDMANLLSOPIPRESOLVE query.
BUG: KMSAN: uninit-value in hexbytepack include/linux/hex.h:13 [inline] BUG: KMSAN: uninit-value in ip6string+0xef4/0x13a0 lib/vsprintf.c:1490 hexbytepack include/linux/hex.h:13 [inline] ip6string+0xef4/0x13a0 lib/vsprintf.c:1490 ip6addrstring+0x18a/0x3e0 lib/vsprintf.c:1509 ipaddrstring+0x245/0xee0 lib/vsprintf.c:1633 pointer+0xc09/0x1bd0 lib/vsprintf.c:2542 vsnprintf+0xf8a/0x1bd0 lib/vsprintf.c:2930 vprintkstore+0x3ae/0x1530 kernel/printk/printk.c:2279 vprintkemit+0x307/0xcd0 kernel/printk/printk.c:2426 vprintkdefault+0x3f/0x50 kernel/printk/printk.c:2465 vprintk+0x36/0x50 kernel/printk/printksafe.c:82 printk+0x17e/0x1b0 kernel/printk/printk.c:2475 ibnlprocessgoodiprsep drivers/infiniband/core/addr.c:128 [inline] ibnlhandleipresresp+0x963/0x9d0 drivers/infiniband/core/addr.c:141 rdmanlrcvmsg drivers/infiniband/core/netlink.c:-1 [inline] rdmanlrcvskb drivers/infiniband/core/netlink.c:239 [inline] rdmanlrcv+0xefa/0x11c0 drivers/infiniband/core/netlink.c:259 netlinkunicastkernel net/netlink/afnetlink.c:1320 [inline] netlinkunicast+0xf04/0x12b0 net/netlink/afnetlink.c:1346 netlinksendmsg+0x10b3/0x1250 net/netlink/afnetlink.c:1896 socksendmsgnosec net/socket.c:714 [inline] socksendmsg+0x333/0x3d0 net/socket.c:729 syssendmsg+0x7e0/0xd80 net/socket.c:2617 syssendmsg+0x271/0x3b0 net/socket.c:2671 syssendmsg+0x1aa/0x300 net/socket.c:2703 compatsyssendmsg net/compat.c:346 [inline] docompatsyssendmsg net/compat.c:353 [inline] secompatsyssendmsg net/compat.c:350 [inline] ia32compatsyssendmsg+0xa4/0x100 net/compat.c:350 ia32syscall+0x3f6c/0x4310 arch/x86/include/generated/asm/syscalls32.h:371 dosyscall32irqson arch/x86/entry/syscall32.c:83 [inline] dofastsyscall32+0xb0/0x150 arch/x86/entry/syscall32.c:306 dofastsyscall32+0x38/0x80 arch/x86/entry/syscall32.c:331 doSYSENTER32+0x1f/0x30 arch/x86/entry/syscall32.c:3
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In RDMA/core handling of RDMA_NL_LS_OP_IP_RESOLVE, use nla_parse_deprecated() to populate the netlink attributes, validate that LS_NLA_TYPE_DGID is present, and fail the request if the DGID attribute is NULL or missing before indexing or processing it.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71096?
CVE-2025-71096 is classified as a medium severity vulnerability affecting the RDMA subsystem in the Linux kernel.
How do I fix CVE-2025-71096?
To fix CVE-2025-71096, update the Linux kernel to the latest version where the vulnerability has been patched.
What does CVE-2025-71096 affect?
CVE-2025-71096 affects the RDMA/core component in the Linux kernel related to the handling of LS_NLA_TYPE_DGID attributes.
Is CVE-2025-71096 exploitable?
CVE-2025-71096 has the potential to be exploited under certain conditions related to improper handling of netlink responses.
When was CVE-2025-71096 disclosed?
CVE-2025-71096 was disclosed as part of ongoing security enhancements to the Linux kernel.