CVE-2025-71080: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71080 is a race condition vulnerability in the Linux kernel's IPv6 per-CPU (pcpu) route handling code, specifically in the rt6_get_pcpu_route() and rt6_make_pcpu_route() functions, that can trigger a kernel panic on PREEMPT_RT kernels. It was published on January 13, 2026, and affects Linux kernel versions 6.12 through 6.12.63, 6.13 through 6.18.3, and release candidates 6.19-rc1 through 6.19-rc8. The vulnerability is classified as CWE-617 (Reachable Assertion) and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, NVD).

The root cause is a time-of-check/time-of-use (TOCTOU) race condition (CWE-617) in the IPv6 routing subsystem of PREEMPT_RT kernels. After rt6_get_pcpu_route() returns NULL, the current task can be preempted; a second task on the same CPU may then call rt6_make_pcpu_route() and successfully install a pcpu_rt entry. When the first task resumes and its cmpxchg() call in rt6_make_pcpu_route() finds rt6i_pcpu is no longer NULL, the BUG_ON(prev) assertion fires, crashing the kernel. Using preempt_disable/enable to guard the critical section is not viable because ip6_rt_pcpu_alloc() may sleep. The fix handles the cmpxchg() failure gracefully on PREEMPT_RT by freeing the redundant allocation and returning the already-installed entry, while replacing BUG_ON with WARN_ON_ONCE on non-PREEMPT_RT kernels (Feedly, NVD).

Successful exploitation results in a kernel panic (system crash), causing a complete denial of service on the affected host. The impact is limited to availability — there is no confidentiality or integrity impact. An attacker with local, low-privilege access on a system running a PREEMPT_RT kernel can trigger the crash with low complexity, potentially affecting any workload or service running on the system (Feedly, NVD).

• Logs: Kernel logs (dmesg, /var/log/kern.log) showing a BUG_ON or kernel panic trace originating from rt6_make_pcpu_route() or related IPv6 routing functions.
• System Behavior: Unexpected system reboots or kernel panics on hosts running PREEMPT_RT kernels, particularly under IPv6 routing load.
• Process: Kernel oops or panic messages referencing rt6i_pcpu, cmpxchg, or rt6_make_pcpu_route in the stack trace.

Apply the official kernel patches: upgrade to Linux kernel 6.12.64 or later for the 6.12.x branch, or 6.18.4 or later for the 6.13–6.18 branches. The fix is also included in 6.19-rc4 and later release candidates. Patches are available at the upstream stable kernel repository. Systems specifically running PREEMPT_RT kernels should be prioritized for patching, as standard (non-RT) kernels are not affected by the crash-inducing BUG_ON path. Ubuntu security notices USN-8162-1, USN-8177-1, USN-8177-2, and USN-8187-1 address this issue for affected Ubuntu releases (Feedly, Ubuntu USN-8177-1).