CVE-2025-71115: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-71115 is a use of uninitialized resource vulnerability (CWE-908) in the Linux kernel's User-Mode Linux (UML) subsystem. The cpu_tasks[] array is not initialized early enough during boot — it is currently initialized in uml_finishsetup() — causing a NULL pointer dereference crash when KCOV (kernel coverage) instrumentation is enabled and early init code calls functions like memparse() that carry coverage annotations. Affected versions span Linux kernel 6.13 through 6.18.2 and 6.19-rc1 through 6.19-rc8. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, MSRC). The CVE was published on January 14, 2026, with NVD initial analysis completed March 25, 2026.

The root cause is classified as CWE-908 (Use of Uninitialized Resource): the cpu_tasks[] array in the UML architecture code is left uninitialized until uml_finishsetup() is called, but certain early kernel initialization routines execute before that point. When KCOV is enabled, functions such as memparse() contain coverage annotations that invoke check_kcov_mode(), which dereferences the current task pointer — which is NULL at that stage — triggering a kernel crash. The fix statically initializes all entries of the cpu_tasks[] array, ensuring the pointer is valid before any annotated code can execute (Feedly). Exploitation requires local access with low privileges and is only reproducible when KCOV instrumentation is active, making it primarily relevant to kernel development and testing environments. Patches are available at kernel.org stable commits 7b5d4416964c and dbbf6d471306 (kernel.org patch 1, kernel.org patch 2).

Successful exploitation results in a local denial of service via a reliable kernel crash (NULL pointer dereference) during system boot or early initialization. There is no confidentiality or integrity impact — only availability is affected (CVSS A:H). The vulnerability is most impactful in kernel development, CI/testing, and fuzzing environments where KCOV is routinely enabled; production systems with KCOV disabled are not affected by this specific crash path (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The EPSS score is approximately 0.018% (0.000180), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Update to Linux kernel version 6.18.3 or later (or 6.19-rc9 and beyond) which include the fix that statically initializes the cpu_tasks[] array (kernel.org patch 1, kernel.org patch 2). As an interim workaround, disabling KCOV instrumentation on affected systems eliminates the crash path entirely, since the vulnerability only manifests when KCOV is enabled. Microsoft Azure Linux users running azl3_kernel_6.6.119.3-1 should apply available updates from Microsoft (MSRC). Production systems are unlikely to have KCOV enabled and are therefore at minimal risk.

Coverage has been limited to standard vulnerability tracking outlets including Yocto Project security mailing lists and German Linux news site pro-linux.de, which reported it as part of broader Linux kernel security update roundups (Feedly). No notable researcher commentary or significant community discussion has been identified beyond routine patch tracking.