CVE-2025-71102: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71102 is a parameter type mismatch bug in the Linux kernel's Shadow Call Stack (SCS) implementation within the __scs_magic() function. The function expects a void * parameter but incorrectly receives a struct task_struct *, causing scs_check_usage() to scan an incorrect memory range when CONFIG_DEBUG_STACK_USAGE is enabled. It was published on January 14, 2026, and affects Linux kernel versions 5.8 through 5.10.247, 5.11 through 5.15.197, 5.16 through 6.1.159, 6.2 through 6.6.119, 6.7 through 6.12.63, 6.13 through 6.18.2, and 6.19-rc1 through rc8. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, kernel.org).

The root cause is a parameter type mismatch (classified as NVD-CWE-noinfo / Insufficient Information) in the __scs_magic() function within the kernel's SCS subsystem. The correct call should pass task_scs(tsk) — the starting address of the task's shadow call stack (vmalloc-allocated) — but instead passes tsk (a struct task_struct * from the slab allocator), causing scs_check_usage() to iterate over a wrong memory range. The attack vector is local, requiring low privileges, and the bug is only triggerable when the kernel is compiled with CONFIG_DEBUG_STACK_USAGE enabled, limiting exposure to debug/development builds (Feedly, kernel.org).

The primary impacts are inaccurate shadow call stack usage statistics appearing in kernel messages (kmsg) and, in an unlikely edge case, a kernel panic if the incorrect memory range causes the scanning loop to access unmapped memory. Because task_struct is typically allocated at lower addresses (slab allocator) and the shadow call stack at higher addresses (vmalloc), the kernel panic scenario is considered unlikely in practice. Production systems without CONFIG_DEBUG_STACK_USAGE enabled are not affected; impact is confined to developers and testers actively using this debug configuration (Feedly, kernel.org).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2025-71102. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), reflecting very low likelihood of exploitation (Feedly). Exploitation is further constrained by the requirement for CONFIG_DEBUG_STACK_USAGE to be enabled, which is not typical in production environments.

Patches are available across all affected stable kernel branches: upgrade to 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, or 6.18.3 (or later) as appropriate for your deployment (Feedly, kernel.org). As an immediate workaround, disable CONFIG_DEBUG_STACK_USAGE in kernel build configurations if active debugging of stack usage is not required. Production systems without this debug option enabled are not impacted and can follow normal patching cycles. Debian (DLA-4475-1, linux 6.1.162-1, linux 5.10.249-1) and Ubuntu (USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, USN-8257-1) have issued updated kernel packages addressing this issue (Ubuntu Advisory, Debian LTS).