CVE-2025-71085: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71085 is a kernel denial-of-service vulnerability in the Linux kernel's IPv6 CALIPSO (Common Architecture Label IPv6 Security Option) implementation, caused by a reachable assertion (CWE-617) in pskb_expand_head(). The flaw was published on January 13, 2026, and affects Linux kernel versions from 4.8.1 through 6.19-rc8, including stable branches up to 5.10.247, 5.15.197, 6.1.159, 6.6.119, 6.12.63, and 6.13–6.18.3. It carries a CVSS v3.1 base score of 5.5 (Medium), requiring local access with low privileges (Feedly, IBM Advisory).

The root cause is an implicit integer cast in __skb_cow() within the calipso_skbuff_setattr() routine. When the computed headroom value exceeds INT_MAX, the check (headroom > skb_headroom(skb)) passes incorrectly, allowing delta = headroom - skb_headroom(skb) to become negative. This negative value is then passed to pskb_expand_head(), triggering a BUG_ON(nhead < 0) assertion at net/core/skbuff.c:2232, causing a kernel oops. The fix restricts skb_cow() calls in calipso_skbuff_setattr() to only grow headroom, preventing the negative value from being passed downstream. A public PoC using the netlabelctl tool and a crafted UDP socket with CALIPSO ancillary data was included in the vulnerability description (Feedly).

Successful exploitation results in an immediate kernel panic and system crash, causing a denial of service with potential data loss due to unclean shutdown. The vulnerability has no confidentiality or integrity impact — only availability is affected. While the primary attack vector is local, remote exploitation is possible if the target system is configured to accept external IPv6 traffic with CALIPSO labels enabled (Feedly).

1. Setup CALIPSO labeling: As a privileged user, configure CALIPSO using netlabelctl: run netlabelctl map del default, netlabelctl calipso add pass doi:7, and netlabelctl map add default address:0::1/128 protocol:calipso,7 to enable CALIPSO label processing for IPv6 loopback traffic.
2. Create a UDP IPv6 socket: Open a raw or UDP socket over IPv6 (socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP)).
3. Craft malicious ancillary data: Construct a msghdr with a CALIPSO-related control message (cmsg_size = 2, cmsg_len = 0x60) designed to produce a headroom delta that overflows the integer boundary when processed by calipso_skbuff_setattr().
4. Send the packet: Transmit the crafted message via sendmsg() targeting the configured CALIPSO-mapped address (e.g., ::1).
5. Trigger kernel panic: The kernel processes the packet through calipso_skbuff_setattr(), computes a headroom value exceeding INT_MAX, passes a negative nhead to pskb_expand_head(), and hits BUG_ON(nhead < 0) at net/core/skbuff.c:2232, crashing the system (Feedly).

• Logs: Kernel oops messages in /var/log/kern.log or dmesg output referencing BUG_ON at net/core/skbuff.c:2232 in pskb_expand_head(); stack traces involving calipso_skbuff_setattr() and __skb_cow().
• System Behavior: Unexpected system reboots or kernel panics on systems with IPv6 and CALIPSO enabled; crash dumps (kdump) referencing the net/core/skbuff.c assertion.
• Network: Unusual IPv6 traffic with CALIPSO extension headers directed at systems with CALIPSO label mappings configured; repeated connection attempts to CALIPSO-mapped addresses from unexpected sources.

Patches are available for multiple stable kernel branches: upgrade to versions 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, or 6.18.4 or later. Stable kernel commits are available at git.kernel.org (e.g., 2bb759062efa, 58fc7342b529, 6b752242452, 73744ad5696d, 86f365897068, bf3709738d8a, c53aa6a5086f). For systems that cannot be patched immediately, disable CALIPSO support if not operationally required, restrict IPv6 traffic at the network perimeter, or apply packet filters to block malformed IPv6 CALIPSO extension headers. IBM Cloud Pak for Data System 1.0 users should refer to the IBM advisory for platform-specific guidance (IBM Advisory, Feedly).

The vulnerability has been addressed by multiple major Linux distributions including Red Hat (RHSA-2026:3488, RHSA-2026:3964, RHSA-2026:4012, RHSA-2026:4246, RHSA-2026:4745, RHSA-2026:5689–5691, RHSA-2026:5727, RHSA-2026:5732, RHSA-2026:5813, RHSA-2026:6193, RHSA-2026:7003), Ubuntu (USN-8177-1/2, USN-8183-1/2, USN-8245-1, USN-8257-1), SUSE, AlmaLinux, Rocky Linux, Oracle Linux, Debian, and Amazon Linux 2. IBM issued an advisory for Cloud Pak for Data System 1.0, and Dell addressed it in DSA-2026-158 and DSA-2026-207. Juniper Networks resolved it in Juniper Secure Analytics 7.5.0-UP15-IF01. No notable independent researcher commentary or social media discussion has been identified beyond standard distribution security advisories (IBM Advisory, Red Hat RHSA-2026:3488, Ubuntu USN-8177-1).