Junglewise Threat Intelligence

CVE-2025-71131: Linux Kernel use-after-free in crypto seqiv

CVE-2025-71131 · Severity: medium · CVSS 5.5 · Published 2026-01-14

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability was identified in the Linux kernel's cryptographic subsystem, specifically affecting how it handles secure communication sequences. In certain scenarios, the system might attempt to access memory that has already been released, which can lead to a system crash or instability. This issue primarily impacts the reliability and availability of systems using these specific encryption methods, including some industrial controllers.

Technical details

A use-after-free vulnerability exists in the Linux kernel crypto/seqiv.c component. The root cause is a race condition where req->iv is dereferenced after the crypto_aead_encrypt call returns; however, in asynchronous operations, the underlying request may have already been freed by a completion handler. An attacker with local access could potentially trigger this invalid memory access to cause a kernel panic (Denial of Service). The fix introduces a local boolean variable 'unaligned_info' to track alignment status independently of the request structure, ensuring no invalid dereferences occur after the encryption call. Patches have been released for various stable kernel branches.

Affected products

  • Linux Linux Kernel 0a270321dbf9 to 50fdb78b7c0b
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6

Timeline

  • 2025-12-17: disclosed: Initial patch authored by Herbert Xu
  • 2026-01-11: patched: Merged into stable kernel trees
  • 2026-01-14: advisory: CVE published

References

Related threats