Login Sign Up

CVE-2025-71157

7.8 HIGH
Denial of Service

📋 TL;DR

A reference counting vulnerability in the Linux kernel's RDMA subsystem could lead to resource exhaustion or kernel instability. The issue occurs when ib_del_sub_device_and_put() fails to properly release device references during error conditions, potentially causing memory leaks. This affects systems using RDMA (Remote Direct Memory Access) functionality.

💻 Affected Systems

Products:
  • Linux kernel
Versions: Specific versions between introduction of nldev_deldev() (commit 060c642b2ab8) and fix commits
Operating Systems: Linux distributions with affected kernel versions
Default Config Vulnerable: ✅ No
Notes: Only vulnerable when RDMA subsystem is enabled and being used. Many systems don't use RDMA by default.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel memory exhaustion leading to system instability, denial of service, or potential privilege escalation if combined with other vulnerabilities.

🟠

Likely Case

Memory leak causing gradual performance degradation or system instability over time, particularly on systems with frequent RDMA device operations.

🟢

If Mitigated

Minimal impact with proper monitoring and resource limits in place.

🌐 Internet-Facing: LOW - RDMA typically requires local network access and specific configurations.
🏢 Internal Only: MEDIUM - Affects systems using RDMA for high-performance computing, storage, or networking within data centers.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ✅ No
Complexity: MEDIUM

Exploitation requires access to RDMA subsystem operations, typically requiring local or network access with appropriate permissions.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with commits 20436f2742a92b7afeb2504eb559a98d2196b001, fa3c411d21ebc26ffd175c7256c37cefa35020aa, or fe8d456080423b9ed410469fbd1e2098d3acce2b

Vendor Advisory: https://git.kernel.org/stable/c/20436f2742a92b7afeb2504eb559a98d2196b001

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version. 2. Check distribution-specific security advisories. 3. Reboot system after kernel update.

🔧 Temporary Workarounds

Disable RDMA subsystem

linux

Prevent exploitation by disabling RDMA functionality if not required

modprobe -r rdma_cm
modprobe -r ib_core
echo 'blacklist rdma_cm' >> /etc/modprobe.d/blacklist.conf
echo 'blacklist ib_core' >> /etc/modprobe.d/blacklist.conf

🧯 If You Can't Patch

  • Monitor system memory usage and kernel logs for signs of memory leaks
  • Restrict access to RDMA operations to trusted users and applications only

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if RDMA modules are loaded: 'uname -r' and 'lsmod | grep -E "(rdma|ib_)"'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched and monitor for memory leaks after RDMA operations

📡 Detection & Monitoring

Log Indicators:

  • Kernel oom-killer messages
  • Memory allocation failures in dmesg
  • RDMA subsystem error messages

Network Indicators:

  • Unusual RDMA traffic patterns

SIEM Query:

source="kernel" AND ("oom" OR "memory" OR "RDMA" OR "ib_")

📊 Metadata

CVE ID: CVE-2025-71157
CVSS v3 Score: 7.8 (HIGH)
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score: 0.02% exploit probability (5.2th percentile)
Published: January 23, 2026
Last Updated: February 26, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON