CVE-2025-71068: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71068 is a bounds-checking flaw in the Linux kernel's svcrdma (RDMA services) subsystem that allows a local low-privileged attacker to access out-of-bounds memory via the inline path handling. The vulnerability was disclosed on January 13, 2026, and affects Linux kernel versions 5.11 through 5.15.197, 6.0 through 6.6.119, 6.12 through 6.12.63, 6.18 through 6.18.2, and 6.19-rc1 through 6.19-rc8. It carries a CVSS v3.1 base score of 7.8 (High) (Feedly, kernel.org patches).

The root cause is a missing array bounds check (classified as NVD-CWE-noinfo / insufficient information, though functionally an out-of-bounds read/write) in the svc_rdma_copy_inline_range function within the kernel's RDMA service (svcrdma) component. Specifically, the function indexes rqstp->rq_pages[rc_curpage] without verifying that rc_curpage remains within the bounds of the allocated page array — both before the first use and after advancing to a new page. An attacker with local access can trigger this condition through crafted RDMA inline data, causing the kernel to access memory outside the intended page array (Feedly, kernel.org patches).

Successful exploitation can result in high impact to confidentiality (information disclosure from kernel memory), integrity (memory corruption), and availability (kernel crash or denial of service). Because the flaw resides in kernel space, a local attacker exploiting it could read sensitive kernel memory contents, corrupt data structures, or destabilize the system. Systems where untrusted users hold local accounts and RDMA services are active are at greatest risk (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges and no user interaction, limiting the attack surface to systems with untrusted local users running RDMA services (Feedly).

Patches are available via the kernel.org stable repositories. Fixed versions include Linux kernel 5.15.198+, 6.6.120+, 6.12.64+, 6.18.3+, and 6.19-rc3+. Administrators should upgrade to the appropriate patched kernel version as the primary remediation. As a temporary workaround on systems that cannot be immediately patched, restrict local account access and consider disabling or limiting RDMA services (svcrdma) if they are not required for business operations (Feedly, kernel.org patches).