CVE-2025-71083: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71083 is a NULL pointer dereference vulnerability in the Linux kernel's DRM (Direct Rendering Manager) TTM (Translation Table Maps) subsystem. The flaw occurs when the devcoredump functionality attempts to read the contents of GPU buffer objects (BOs) that have been evicted and are no longer associated with a resource — the code fails to handle this resourceless state, triggering a NULL pointer dereference. It was published on January 13, 2026, and affects Linux kernel versions from 4.14 through multiple stable branches up to 6.18.x and 6.19-rc releases. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, kernel.org patch).

The root cause is classified as CWE-476 (NULL Pointer Dereference). When the kernel's devcoredump subsystem iterates over all GPU buffer objects to capture a core dump, it does not account for BOs that have been evicted from GPU memory and thus have no associated resource pointer. Dereferencing this NULL resource pointer causes a kernel panic. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction, making it exploitable by any local user on a system with GPU hardware and the DRM TTM subsystem active (Feedly).

Successful exploitation causes a kernel panic, resulting in a system crash and denial of service. The impact is limited to availability (no confidentiality or integrity impact), but a crash can render affected systems completely unavailable until rebooted. Systems running GPU workloads — such as graphics servers, compute nodes, or desktops with discrete GPUs — are most at risk, particularly those where devcoredump is triggered during or after GPU memory pressure events that cause BO eviction (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. No threat actor attribution has been identified.

• Logs: Unexpected kernel panic messages in /var/log/kern.log or dmesg output referencing a NULL pointer dereference in the drm/ttm or devcoredump code path (e.g., BUG: kernel NULL pointer dereference with stack traces involving TTM or DRM functions).
• System Behavior: Sudden system reboots or crashes on hosts with GPU hardware, particularly during or after periods of high GPU memory utilization that trigger buffer object eviction.
• File System: Presence of unexpected kernel core dump files generated by devcoredump in /sys/class/devcoredump/ prior to a crash.

Update the Linux kernel to a patched version: 5.15.198 or later, 6.1.160 or later, 6.6.120 or later, 6.12.64 or later, 6.18.4 or later, or 6.19-rc1 or later, depending on the current kernel branch in use (Feedly). Upstream patches are available via the Linux stable tree at multiple commit hashes (e.g., 3d004f73, 491adc6a, 4b994449, 5a81095d, b94182b3). As a temporary workaround where patching is not immediately possible, restricting local user access on systems with GPU hardware reduces exposure. Distributions including Ubuntu (USN-8177-1, USN-8183-1, USN-8245-1, USN-8257-1), Debian, Oracle Linux, and Amazon Linux 2 have issued updated kernel packages (Ubuntu Advisory).

Microsoft published a patch advisory for this CVE on January 15, 2026, covering the Azure Linux (AZL3) kernel (Microsoft MSRC). Multiple Linux distributions including Ubuntu, Debian, and Oracle Linux have issued security advisories and updated kernel packages. No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability, consistent with its medium severity and local-only attack vector.