CVE-2025-71109: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71109 is a memory corruption vulnerability in the Linux kernel's MIPS ftrace implementation, triggered when the kernel is located beyond 32-bit address boundaries. The flaw was introduced following commit e424054000878 ("MIPS: Tracing: Reduce the overhead of dynamic Function Tracer") and affects Linux kernel versions from 2.6.35 through 6.12.63 and 6.13 through 6.18.2, as well as 6.19 release candidates. It was published on January 14, 2026, with NVD initial analysis completed on March 25, 2026. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, kernel.org patches).

The root cause is an out-of-bounds write (CWE-787) in the MIPS ftrace subsystem. The macro UASM_i_LA_mostly (and UASM_i_LA) can generate more than 2 machine instructions, but the ftrace code stores generated instructions in a fixed-size int[2] array, assuming a maximum of 2 instructions. When the kernel's _mcount symbol is located beyond 32-bit addressing, the macro generates additional instructions that overflow this buffer, corrupting adjacent variables in the __read_mostly kernel section. The fix avoids generating instructions when they would exceed 2 in length, limiting dynamic ftrace scope to within the kernel code section but preventing the memory corruption (Feedly).

Exploitation of this vulnerability results in corruption of kernel data structures in the __read_mostly section, with a confirmed real-world impact of corrupting the __cpu_primary_thread_mask variable, causing the system to hang very early during boot. The availability impact is rated High, as affected MIPS systems with dynamic ftrace enabled and kernel memory extending beyond 32-bit boundaries become non-functional. There is no confidentiality or integrity impact beyond the memory corruption itself (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges on a MIPS-architecture system where the kernel is loaded beyond 32-bit address space and dynamic ftrace is enabled, significantly limiting the attack surface. The EPSS score is approximately 0.017% (0.000170), reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

Apply the stable kernel patches available at kernel.org: upgrade to Linux kernel 6.12.64 or later (for the 6.12.x line) or 6.18.3 or later (for 6.13+ lines). Three specific commits address this issue: 36dac9a3dda1f2bae343191bc16b910c603cac25, 7f39b9d0e86ed6236b9a5fb67616ab1f76c4f150, and e3e33ac2eb69d595079a1a1e444c2fb98efdd42d. As a temporary workaround on unpatched systems, disabling MIPS dynamic ftrace functionality can prevent the buffer overflow from occurring. Ubuntu has also released security notices (USN-8183-1, USN-8183-2, USN-8245-1, USN-8257-1) addressing this issue (Feedly, Ubuntu USN-8183-1).

Ubuntu issued multiple security notices (USN-8183-1, USN-8183-2, USN-8245-1, USN-8257-1) addressing this vulnerability in their kernel packages. The Yocto Project security mailing list also tracked this CVE across several messages. Coverage has been limited to standard Linux security advisory channels, with no notable researcher commentary or broader media attention, consistent with the niche MIPS-specific scope of the vulnerability (Ubuntu USN-8183-1, Ubuntu USN-8183-2).