Executive brief
A vulnerability in the Linux kernel's IPv6 networking component can cause a system crash (kernel panic) on systems using the Real-Time (PREEMPT_RT) configuration. This occurs when multiple networking tasks conflict while managing internal routing data on the same processor. An exploit could lead to a complete denial of service, disrupting all operations on the affected server or device.
Technical details
A race condition exists in net/ipv6/route.c within the rt6_make_pcpu_route() function. On kernels configured with PREEMPT_RT, a task can be preempted after rt6_get_pcpu_route() returns NULL but before it completes the installation of a new per-CPU route. If another task on the same CPU installs a route in the interim, the original task's subsequent cmpxchg() call fails, triggering a BUG_ON(prev) assertion. This results in a kernel panic and denial of service. The fix replaces the fatal BUG_ON with graceful handling that frees the redundant allocation and returns the existing route.
Affected products
- Linux Linux Kernel 6.12 through 6.12.63, 6.13 through 6.18.3
Timeline
- 2025-12-23: disclosed: Initial patch submitted by Jiayuan Chen
- 2025-12-30: patched: Patch committed to stable tree
- 2026-01-13: advisory: CVE-2025-71080 published