CVE-2025-71084: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71084 is a memory leak vulnerability in the Linux kernel's RDMA/cm (Remote Direct Memory Access Connection Manager) subsystem, specifically in the handling of multicast GID (Global Identifier) table references. When a CM ID is destroyed while a CM event for multicast creation is still queued, cancel_work_sync() prevents the work from running, which in turn prevents the ah_attr (address handle attribute) from being properly destroyed — leaking a reference count and triggering kernel warnings. Affected kernel versions span multiple stable branches: 5.10.20–5.10.247, 5.11.3–5.12, 5.12.1–5.15.197, 5.16–6.1.159, 6.2–6.6.119, 6.7–6.12.63, 6.13–6.18.3, and 6.19-rc1 through rc8. The vulnerability was published on January 13, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, NVD).

The root cause is a resource management flaw (classified as NVD-CWE-Other) in the RDMA Connection Manager within drivers/infiniband/core/cm.c. When a race condition occurs between CM ID destruction and a queued multicast creation work item, cancel_work_sync() halts the pending work before it can call the ah_attr destructor, which is responsible for releasing the GID table reference. This causes the reference counter in drivers/infiniband/core/cache.c to never reach zero, producing kernel warnings such as GID entry ref leak for dev syz1 index 2 ref=573 at gid_table_release_one+0x284/0x3cc. The fix ensures ah_attr is explicitly destroyed after cancel_work_sync() completes, which is safe to invoke twice (NVD, Feedly).

Exploitation of this vulnerability leads to resource exhaustion and potential denial of service on systems using InfiniBand RDMA connections. As GID table reference counts accumulate without being released, system memory and kernel resources are progressively depleted, degrading performance and potentially causing system instability or crashes. There is no confidentiality or integrity impact; the effect is limited to availability, and it is confined to the local system running the vulnerable kernel with RDMA/InfiniBand hardware (NVD, Feedly).

• Logs: Kernel warning messages in dmesg or system logs such as GID entry ref leak for dev <device> index <N> ref=<high_value> and WARNING: CPU: X PID: Y at drivers/infiniband/core/cache.c:809 gid_table_release_one.
• System Behavior: Gradual increase in kernel memory usage on systems with InfiniBand/RDMA hardware; repeated kernel WARN traces in /var/log/kern.log or journalctl -k related to release_gid_table or gid_table_release_one.
• Performance: Unexplained degradation in RDMA throughput or system responsiveness on InfiniBand-connected nodes, potentially correlating with frequent CM ID creation/destruction cycles.

Apply kernel updates to the following patched versions: 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, or 6.18.4 (or later). Multiple stable-branch patches are available from kernel.org. As an interim measure if patching is not immediately possible, limit the rate of CM ID creation and destruction in RDMA workloads, and monitor InfiniBand system logs for GID reference leak warnings. Distributions including Debian, Ubuntu, Amazon Linux 2, and Oracle Linux have issued updated kernel packages incorporating this fix (NVD, Ubuntu USN-8177-1, Debian LTS).