UBUNTU-CVE-2025-71080: Medium severity ubuntu/linux-hwe-edge vulnerability

Q: Which systems are most directly exposed to the race condition?

PREEMPT_RT Linux kernels are the primary affected environment. The issue occurs when two tasks on the same CPU race to create and install a per-CPU IPv6 route entry.

Q: What level of access does an attacker need?

The supplied severity vector indicates local access and low privileges are required, with no user interaction. The attack complexity is low, although the vector also indicates an additional attack requirement is present.

Q: What is the practical impact if the race is triggered?

The race can trigger a kernel BUG in rt6_make_pcpu_route(), causing an availability impact. The provided vector indicates no confidentiality or integrity impact, while availability impact is high.

Q: How does the fix handle the competing route installation?

If another task has installed the per-CPU route entry first, the kernel frees the allocation made by the losing task and returns the existing entry. On non-PREEMPT_RT kernels, the BUG_ON is replaced with WARN_ON_ONCE because the race should not normally occur there.

Published Jan 13, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix a BUG in rt6getpcpuroute() under PREEMPTRT On PREEMPTRT kernels, after rt6getpcpuroute() returns NULL, the current task can be preempted. Another task running on the same CPU may then execute rt6makepcpuroute() and successfully install a pcpurt entry. When the first task resumes execution, its cmpxchg() in rt6makepcpuroute() will fail because rt6ipcpu is no longer NULL, triggering the BUGON(prev). It's easy to reproduce it by adding mdelay() after rt6getpcpuroute(). Using preemptdisable/enable is not appropriate here because ip6rtpcpualloc() may sleep. Fix this by handling the cmpxchg() failure gracefully on PREEMPTRT: free our allocation and return the existing pcpurt installed by another task. The BUGON is replaced by WARNONONCE for non-PREEMPTRT kernels where such races should not occur.

Affected Software

167 affected componentsFixes available

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.15*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.15*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.15*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.15*

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm-5.15*

ubuntu/linux-intel-5.13*

ubuntu/linux-intel-iotg-5.15*

ubuntu/linux-lowlatency-hwe-5.15*

ubuntu/linux-nvidia-tegra-5.15<5.15.0-1057.57~20.04.1

5.15.0-1057.57~20.04.1

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.15*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.15*

ubuntu/linux-riscv-5.8*

ubuntu/linux*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8*

ubuntu/linux-azure*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8*

ubuntu/linux-gke*

ubuntu/linux-gkeop*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm*

ubuntu/linux-ibm-6.8*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg*

ubuntu/linux-kvm*

ubuntu/linux-lowlatency*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8*

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8*

ubuntu/linux-nvidia-tegra<5.15.0-1057.57

5.15.0-1057.57

ubuntu/linux-nvidia-tegra-igx<5.15.0-1046.46

5.15.0-1046.46

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle*

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8*

ubuntu/linux-raspi*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp*

ubuntu/linux-bluefield*

ubuntu/linux-intel-iot-realtime<5.15.0-1097.99

5.15.0-1097.99

ubuntu/linux-realtime<5.15.0-1104.113

5.15.0-1104.113

ubuntu/linux-realtime-6.8<6.8.1-1047.48~22.04.1

6.8.1-1047.48~22.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-azure*

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-nvidia*

ubuntu/linux-gcp*

ubuntu/linux-gcp-6.11*

ubuntu/linux-gke*

ubuntu/linux-gkeop*

ubuntu/linux-hwe-6.11*

ubuntu/linux-ibm*

ubuntu/linux-lowlatency*

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17<6.17.0-1018.18

6.17.0-1018.18

ubuntu/linux-nvidia-lowlatency*

ubuntu/linux-nvidia-tegra<6.8.0-1022.22

6.8.0-1022.22

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle*

ubuntu/linux-raspi*

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-vmware*

ubuntu/linux-xilinx*

ubuntu/linux-bluefield*

ubuntu/linux-raspi-realtime<6.8.0-2042.43

6.8.0-2042.43

ubuntu/linux-realtime<6.8.1-1047.48

6.8.1-1047.48

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17<6.17.0-1010.11~24.04.1

6.17.0-1010.11~24.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<6.17.0-22.22

6.17.0-22.22

ubuntu/linux-realtime<6.17.0-1010.11

6.17.0-1010.11

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1057.57~20.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 5.15.0-1057.57
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-igx to a version that resolves this vulnerability.
Fixed in 5.15.0-1046.46
Upgrade
Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1097.99
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1104.113
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1047.48~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1018.18
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1022.22
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2042.43
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1047.48
Upgrade
Upgrade ubuntu/linux-realtime-6.17 to a version that resolves this vulnerability.
Fixed in 6.17.0-1010.11~24.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.17.0-22.22
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.17.0-1010.11
Compensating control
In rt6_make_pcpu_route() on PREEMPT_RT, handle cmpxchg() failure gracefully: free the newly allocated route and return the existing pcpu_rt entry installed by another task; replace BUG_ON(prev) with WARN_ON_ONCE for non-PREEMPT_RT kernels.

Event History

Jan 13, 2026

CVE Published

via OSV·04:16 PM

Data Sourced

via OSV·04:16 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are most directly exposed to the race condition?

PREEMPT_RT Linux kernels are the primary affected environment. The issue occurs when two tasks on the same CPU race to create and install a per-CPU IPv6 route entry.

What level of access does an attacker need?

The supplied severity vector indicates local access and low privileges are required, with no user interaction. The attack complexity is low, although the vector also indicates an additional attack requirement is present.

What is the practical impact if the race is triggered?

The race can trigger a kernel BUG in rt6_make_pcpu_route(), causing an availability impact. The provided vector indicates no confidentiality or integrity impact, while availability impact is high.

How does the fix handle the competing route installation?

If another task has installed the per-CPU route entry first, the kernel frees the allocation made by the losing task and returns the existing entry. On non-PREEMPT_RT kernels, the BUG_ON is replaced with WARN_ON_ONCE because the race should not normally occur there.

UBUNTU-CVE-2025-71080: Medium severity ubuntu/linux-hwe-edge vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are most directly exposed to the race condition?

What level of access does an attacker need?

What is the practical impact if the race is triggered?

How does the fix handle the competing route installation?

Company

Resources

Contact

Frequently Asked Questions

Which systems are most directly exposed to the race condition?

What level of access does an attacker need?

What is the practical impact if the race is triggered?

How does the fix handle the competing route installation?