CVE-2025-71113: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71113 is a use of uninitialized resource vulnerability in the Linux kernel's crypto user API (af_alg) socket interface. Memory allocated via sock_kmalloc() for crypto contexts and requests is not zero-initialized, leaving fields — particularly the inflight variable introduced by commit 67b164a871af — in an undefined state that causes intermittent denial of service. The vulnerability was published on January 14, 2026, and affects a wide range of Linux kernel versions from 2.6.38 through 6.19-rc8, as well as Microsoft's Azure Linux kernel (azl3_kernel_6.6.119.3-3). It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, Microsoft MSRC).

The root cause is classified as CWE-908 (Use of Uninitialized Resource): sock_kmalloc() allocations for af_alg crypto contexts and AIO request structures are not memset to zero, leaving fields in an indeterminate state. The specific trigger is the inflight boolean variable in af_alg_ctx, added to prevent multiple concurrent in-flight AIO requests; because it is never initialized, it may contain garbage values that evaluate as truthy, causing af_alg_alloc_areq() to return -EBUSY spuriously. The attack vector is local with low privileges required — a local user can trigger the condition simply by initiating cryptographic operations through the AF_ALG socket interface. The affected interface files include crypto/af_alg.c, algif_kpp.c, and algif_akcipher.c (Feedly).

The primary impact is a high-severity availability disruption: legitimate cryptographic AIO operations fail intermittently and unpredictably with -EBUSY errors, disrupting any application or service relying on the kernel's AF_ALG crypto interface. There is no confidentiality or integrity impact, as the uninitialized data does not leak to user space and cannot be used to corrupt kernel state in an exploitable way. The scope is limited to the local system, with no evidence of lateral movement potential or data exposure risk (Feedly).

Patches are available in the Linux stable kernel repository for all affected version branches. Fixed versions include: 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, and 6.18.3. Multiple stable-tree patches have been committed to git.kernel.org. Downstream distributions including Debian, SUSE, Oracle Linux, and Amazon Linux 2 have issued updated kernel packages. As a temporary workaround where patching is not immediately feasible, administrators should restrict local user access to the AF_ALG crypto socket interface. Microsoft has also patched the affected Azure Linux kernel (azl3_kernel_6.6.119.3-3) (Microsoft MSRC, Feedly).