Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user to crash the system. The issue occurs when processing specific IPv6 network packets using the CALIPSO protocol, which is used for labeling network traffic. An exploit would result in a 'kernel oops' or system crash, leading to a denial of service and potentially disrupting business operations or industrial processes running on affected hardware.
Technical details
A reachable assertion (BUG_ON) exists in net/core/skbuff.c within the pskb_expand_head() function. The vulnerability is rooted in an implicit integer cast in __skb_cow() when called by calipso_skbuff_setattr(). When a specially crafted IPv6 packet with CALIPSO options results in a headroom calculation exceeding INT_MAX, the delta becomes negative, bypassing safety checks and passing a negative value to pskb_expand_head(). A local attacker can trigger this by sending a UDP packet with specific IPv6 hop-by-hop options after configuring CALIPSO via netlabelctl. Patches have been released for various stable Linux kernel branches to ensure skb_cow() is only used to grow headroom.
Affected products
- Linux Linux versions prior to 2025-12-29 patches
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 and later
Timeline
- 2025-12-19: disclosed: Vulnerability reported by Will Rosenberg
- 2025-12-29: patched: Initial patch committed to mainline kernel
- 2026-01-13: advisory: CVE-2025-71085 published
References
- https://git.kernel.org/stable/c/2bb759062efa188ea5d07242a43e5aa5464bbae1
- https://git.kernel.org/stable/c/58fc7342b529803d3c221101102fe913df7adb83
- https://git.kernel.org/stable/c/6b7522424529556c9cbc15e15e7bd4eeae310910
- https://git.kernel.org/stable/c/73744ad5696dce0e0f43872aba8de6a83d6ad570
- https://git.kernel.org/stable/c/86f365897068d09418488165a68b23cb5baa37f2
- https://git.kernel.org/stable/c/bf3709738d8a8cc6fa275773170c5c29511a0b24
- https://git.kernel.org/stable/c/c53aa6a5086f03f19564096ee084a202a8c738c0