CVE-2025-71096: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71096 is an uninitialized memory read vulnerability in the Linux kernel's RDMA/core netlink handler, classified under CWE-908 (Use of Uninitialized Resource). The flaw exists in the handling of RDMA_NL_LS_OP_IP_RESOLVE netlink responses, where the kernel fails to properly validate the presence of the required LS_NLA_TYPE_DGID attribute before processing it, allowing uninitialized stack memory to be read. Affected kernel versions span from 4.7 through multiple stable series up to (but not including) the fixed releases. It was published on January 13, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Microsoft MSRC).

The root cause is improper netlink attribute validation in the RDMA/core subsystem (CWE-908). When the kernel processes a RDMA_NL_LS_OP_IP_RESOLVE response from userspace, it previously used a for-loop to search for the LS_NLA_TYPE_DGID attribute rather than using nla_parse_deprecated() to fill the nlattrs array and directly index it. If userspace omits the DGID attribute, the kernel proceeds to read uninitialized stack memory, which can be exposed via kernel logging (e.g., printk) as demonstrated by the KMSAN report showing an uninit-value read in hex_byte_pack → ip6_string → ip6_addr_string. The fix squashes validation and parsing into one function and fails explicitly if the attribute is NULL (Red Hat CVE, Kernel Patch).

A low-privileged local attacker can trigger this vulnerability by sending a malformed RDMA netlink message without the required DGID attribute, causing the kernel to read and potentially expose uninitialized stack memory. This can result in disclosure of sensitive kernel memory contents — potentially including cryptographic keys, pointer addresses, or other confidential data — through kernel logging mechanisms. Additionally, the uninitialized memory read can trigger unexpected behavior in dependent code paths, leading to denial of service via kernel crashes or hangs. Confidentiality and availability are both at risk, while integrity is not directly affected (Red Hat CVE).

• Logs: Kernel log entries containing KMSAN warnings such as BUG: KMSAN: uninit-value in hex_byte_pack or BUG: KMSAN: uninit-value in ip6_string originating from RDMA netlink processing code paths.
• Logs: Kernel oops or crash reports referencing ip6_addr_string, ip_addr_string, pointer, or vsnprintf in the context of RDMA/core netlink handling.
• Process: Unusual local processes sending RDMA netlink messages (RDMA_NL_LS_OP_IP_RESOLVE) without the expected LS_NLA_TYPE_DGID attribute, particularly from non-administrative user accounts.

Apply the latest stable kernel patches for your kernel series: 5.10.248+, 5.15.198+, 6.1.160+, 6.6.120+, 6.12.64+, or 6.18.4+. Azure Linux 3 users should update to kernel 6.6.119.3-3 or later. Debian, Ubuntu (USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, USN-8257-1), Amazon Linux 2, and Oracle Linux have all issued updated packages. If immediate patching is not possible, restrict local user access to RDMA netlink interfaces using Linux Security Modules (SELinux or AppArmor) and monitor system logs for KMSAN warnings related to RDMA netlink processing (Red Hat CVE, Kernel Patch, Ubuntu USN-8177-1).