CVE-2025-71095: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71095 is a kernel panic vulnerability in the Linux kernel's net: stmmac network driver triggered by zero copy XDP_TX actions. The flaw was published on January 13, 2026, and affects Linux kernel versions 5.13 through 6.1.159, 6.2 through 6.6.119, 6.7 through 6.12.63, and 6.13 through 6.18.3, as well as the Microsoft AZL3 kernel 6.6.119.3-3. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, kernel.org patch).

The root cause is a missing memory type validation in the stmmac_xdp_xmit_back() function within the stmmac Ethernet driver (CWE: Insufficient Information / NVD-CWE-noinfo). When an XDP_TX action is processed, xdp_convert_buff_to_frame() converts an xdp_buff to an xdp_frame; the resulting memory type depends on the source buffer — page pool buffers yield MEM_TYPE_PAGE_POOL, while zero copy AF_XDP socket (XSK) pool buffers yield MEM_TYPE_PAGE_ORDER0. Because stmmac_xdp_xmit_back() unconditionally assumes the page pool memory type, it generates invalid DMA mappings when processing XSK zero copy buffers, leading to an invalid kernel paging request at virtual address fffeffff80000000 and a fatal kernel panic in the interrupt handler. Exploitation requires local access with low privileges and the ability to trigger zero copy XDP_TX operations on an affected interface (Feedly).

Successful exploitation causes an immediate kernel panic and system crash (denial of service), requiring a forced reboot to recover. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue affecting the entire system. Systems most at risk include network appliances, containers, and high-performance packet processing environments that use AF_XDP sockets with zero copy mode enabled on stmmac-based network interfaces (Feedly).

• Logs: Kernel logs (dmesg / /var/log/kern.log) showing Unable to handle kernel paging request at virtual address fffeffff80000000, Internal error: Oops: 0000000096000144, and call traces through dcache_clean_poc, __dma_sync_single_for_device, stmmac_xdp_xmit_xdpf, __stmmac_xdp_run_prog, stmmac_napi_poll_rxtx, and __napi_poll.
• System Events: Unexpected system reboots or kernel panics on hosts running stmmac-based NICs with AF_XDP zero copy mode enabled.
• Process/Network: Processes using AF_XDP sockets (AF_XDP socket creation visible via ss -x or strace) on systems with stmmac network interfaces immediately preceding a crash.

Patches are available in the following stable kernel versions: 6.1.160, 6.6.120, 6.12.64, 6.18.4, and 6.19-rc4 and later. Specific upstream fix commits are 3f7823219407, 45ee0462b883, 4d0ceb7677e1, 5e5988736a95, and a48e232210009 on git.kernel.org. As an interim workaround if patching is not immediately possible, disable zero copy XDP functionality and AF_XDP socket (XSK) operations on affected systems, and restrict local access to privileged users. Downstream distributions including Debian (linux 6.1.162-1) and Ubuntu (USN-8177-1, USN-8183-1, USN-8245-1, USN-8257-1) have also released updated packages (Ubuntu Advisory, Feedly).

The vulnerability received routine coverage from Linux distribution security teams, with Debian and Ubuntu issuing kernel update advisories. The Yocto Project security mailing list also tracked the issue across multiple messages. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability database and distribution advisory channels.