LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71080: ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT On PREEMPT_RT kernels, after rt6_get_pcpu_route() returns NULL, the current task can be preempted. Another task running on the same CPU may then execute rt6_make_pcpu_route() and successfully install a pcpu_rt entry. When the first task resumes execution, its cmpxchg() in rt6_make_pcpu_route() will fail because rt6i_pcpu is no longer NULL, triggering the BUG_ON(prev). It's easy to reproduce it by adding mdelay() after rt6_get_pcpu_route(). Using preempt_disable/enable is not appropriate here because ip6_rt_pcpu_alloc() may sleep. Fix this by handling the cmpxchg() failure gracefully on PREEMPT_RT: free our allocation and return the existing pcpu_rt installed by another task. The BUG_ON is replaced by WARN_ON_ONCE for non-PREEMPT_RT kernels where such races should not occur.

HighCVSS 7.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A race condition in Linux IPv6 route handling can trigger a kernel BUG and crash affected real-time systems, causing service interruption. The issue specifically concerns PREEMPT_RT kernels. It does not expose data or alter information according to the supplied CVSS assessment, but affected network-facing systems may suffer high availability impact.

Executive priority

Prioritize prompt assessment and patching of critical PREEMPT_RT network systems. Standard Linux deployments without PREEMPT_RT appear outside the described race condition. Escalate systems where a kernel crash would interrupt essential services, while avoiding claims of active attacks absent supporting evidence.

Technical view

On PREEMPT_RT, a task may be preempted after finding no per-CPU IPv6 route. Another task can install that route before the first task resumes, causing its atomic comparison-and-swap to fail and trigger BUG_ON. The correction handles this race by freeing the redundant allocation and returning the route installed by the competing task.

Likely exposure

Exposure is limited to Linux systems using PREEMPT_RT with IPv6 and an affected kernel. The bundle identifies versions including 6.12, 6.12.64, 6.18.4, and 6.19, but does not clearly define all affected version boundaries or distribution-specific package status.

Exploitation context

The supplied CVSS vector rates the issue network-accessible, low complexity, unauthenticated, and availability-only. However, the bundle provides no public exploit evidence, attack details, or confirmation of active exploitation. It is not listed in KEV. Treat practical remote reachability as requiring environment-specific validation.

Researcher notes

The flaw is a concurrency race in rt6_get_pcpu_route() and rt6_make_pcpu_route(). Disabling preemption is unsuitable because ip6_rt_pcpu_alloc() may sleep. The fix treats comparison-and-swap failure as a recoverable race on PREEMPT_RT; non-PREEMPT_RT retains a one-time warning because the race is not expected there.

Mitigation direction

  • Apply a vendor-supported kernel containing the referenced stable correction.
  • Prioritize PREEMPT_RT systems that enable IPv6 and provide critical network services.
  • Check distribution security guidance for corrected package versions and affected-version boundaries.
  • Use operational redundancy while kernel updates and required restarts are scheduled.

Validation and detection

  • Confirm whether each system runs a PREEMPT_RT kernel.
  • Identify the deployed kernel and distribution package versions.
  • Verify whether IPv6 is enabled and operationally reachable.
  • Confirm the installed kernel includes the relevant stable fix or vendor backport.
  • Review kernel logs for related BUG or WARN events and unexpected restarts.
Prepared
Confidence
high
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71080 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
4Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2025-71080Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd2d6422f8bd17c6bb205133e290625a564194496, d2d6422f8bd17c6bb205133e290625a564194496, d2d6422f8bd17c6bb205133e290625a564194496unaffected
LinuxLinux6.12, 0, 6.12.64, 6.18.4, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.