CVE-2025-71110: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2025-71110 is a use-after-free (UAF) vulnerability in the Linux kernel's SLUB memory allocator (mm/slub) that affects ARM64 systems with Memory Tagging Extension (MTE) support when CONFIG_SLUB_TINY is enabled. The flaw was published on January 14, 2026, and affects Linux kernel versions 6.18, 6.18.1, 6.18.2, and 6.19-rc1 through 6.19-rc8. It carries a CVSS v3.1 base score of 7.8 (High), exploitable locally by a low-privileged attacker with no user interaction required (Feedly, NVD).

The root cause (CWE-416: Use After Free) lies in the ordering of operations within kfree_nolock() when CONFIG_SLUB_TINY is enabled. kasan_slab_free() is called first, which poisons the freed memory region and changes the ARM64 MTE pointer tag from its original value (e.g., 0xf3) to a poison tag (0xfe). When defer_free() subsequently attempts to write to the same freed object to build the deferred free list via llist_add(), the pointer still carries the old tag, causing a tag mismatch that triggers a KASAN use-after-free report: BUG: KASAN: slab-use-after-free in defer_free+0x3c/0xbc mm/slub.c:6537. The fix involves calling kasan_reset_tag() before defer_free() accesses the freed memory, which is safe because defer_free() is an internal allocator function expected to manipulate freed memory for bookkeeping (Feedly, NVD).

Successful exploitation by a local, low-privileged attacker can result in kernel memory corruption, potentially leading to high impact on confidentiality, integrity, and availability. An attacker could leverage this vulnerability to read sensitive kernel memory (information disclosure), corrupt kernel data structures (integrity loss), or cause a kernel panic/system crash (denial of service). The vulnerability is scoped to the local system and does not directly enable network-based lateral movement, but kernel-level compromise could facilitate privilege escalation (Feedly).

Upgrade the Linux kernel to version 6.18.3 or later, which contains the fix. The patches are available at two commits in the stable kernel tree: 53ca00a and 65d4e5a. Systems running kernel 6.18, 6.18.1, 6.18.2, or any 6.19-rc release on ARM64 hardware with MTE enabled should be prioritized for patching. As a temporary workaround where upgrading is not immediately possible, disabling CONFIG_SLUB_TINY or MTE (if operationally feasible) would prevent the vulnerable code path from being triggered (Feedly, NVD).