CVE-2025-71079: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71079 is a deadlock vulnerability in the Linux kernel's NFC (Near Field Communication) subsystem caused by a lock ordering inversion between device_lock and rfkill_global_mutex. It affects multiple Linux kernel stable branches, including versions from 4.9.291 through 6.18.x (prior to fixed releases), as well as 6.19 release candidates, and Microsoft's Azure Linux 3 kernel (6.6.119.3-3). The vulnerability was published on January 13, 2026, with patches added to stable branches by March 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Microsoft MSRC).

The root cause is improper locking (CWE-667) — specifically a classic ABBA deadlock scenario in the NFC subsystem. Thread A (rfkill_fop_write) acquires rfkill_global_mutex first, then attempts to acquire device_lock via nfc_dev_down(); Thread B (nfc_unregister_device) acquires device_lock first, then attempts to acquire rfkill_global_mutex via rfkill_unregister(). The fix moves rfkill_unregister() and rfkill_destroy() outside the device_lock critical section in nfc_unregister_device(), storing the rfkill pointer in a local variable before releasing the lock, which eliminates the inversion. Exploitation requires local access with low privileges and no user interaction (Feedly).

Successful exploitation causes a denial of service (DoS) condition where the affected system hangs or becomes unresponsive indefinitely due to the deadlock. There is no confidentiality or integrity impact — only availability is affected. The attack is limited to the local system and does not enable lateral movement or data exfiltration (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating very low probability of exploitation in the near term. The attack requires only low privileges and local access, making it theoretically accessible to unprivileged local users, but the lack of public tooling significantly limits practical risk (Feedly).

Apply kernel updates to the following fixed versions depending on your deployment baseline: 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, or 6.18.4. For older stable branches, fixes are also available for versions prior to 4.15, 4.20, and 5.5. Azure Linux 3 users should apply Microsoft's security updates addressing kernel version 6.6.119.3-3. Debian users should update to linux 6.1.162-1 (oldstable) or 5.10.249-1 (oldoldstable) per Debian security advisories; Ubuntu users should apply USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, or USN-8257-1 as applicable. As a temporary measure, restricting local user access to NFC-capable systems can reduce attack surface until patches are applied (Feedly, Microsoft MSRC, Debian LTS, Ubuntu USN-8177-1).

The vulnerability received routine coverage from Linux distribution security teams, with Debian, Ubuntu, and Yocto Project all issuing advisories and updated packages. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vendor patch notifications (Ubuntu USN-8177-1, Debian LTS).