CVE-2025-71118: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71118 is a NULL pointer dereference vulnerability in the Linux kernel's ACPICA namespace walking functionality. It was published on January 14, 2026, and affects a wide range of Linux kernel versions from 2.6.12 through 6.19-rc releases, including specific vulnerable ranges: prior to 5.10.248, 5.11.x–5.15.x (prior to 5.15.198), 5.16.x–6.1.x (prior to 6.1.160), 6.2.x–6.6.x (prior to 6.6.120), 6.7.x–6.12.x (prior to 6.12.64), and 6.13.x–6.18.x (prior to 6.18.3). Microsoft Azure Linux (azl3_kernel_6.6.119.3-3) is also affected. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, kernel.org patches).

The root cause is a NULL pointer dereference (CWE-476) in the acpi_ns_get_next_node() function within the ACPICA namespace walking code. A prior fix (commit 0c9992315e73) addressed the case where both start_node and acpi_gbl_root_node are NULL, but failed to guard against the case where only start_node is NULL — the check was incorrectly placed inside a conditional block. When the kernel processes a malformed ACPI DSDT (Differentiated System Description Table) during boot, start_node can be NULL, causing an unconditional dereference of parent_node and a kernel panic. The fix moves the NULL check for start_node outside the conditional block to ensure it is always evaluated. This was confirmed to trigger on Honor Magicbook 14 Pro systems with BIOS 1.13 (05/08/2025) carrying a malformed DSDT table (Feedly).

Successful triggering of this vulnerability results in a kernel panic, causing a complete denial of service (DoS) by crashing the affected system. There is no confidentiality or integrity impact — the vulnerability is limited to availability. The attack requires local access with low privileges and no user interaction, and is most likely to manifest on hardware with a malformed ACPI DSDT table (e.g., Honor Magicbook 14 Pro with BIOS 1.13). Lateral movement or data exfiltration are not applicable given the DoS-only nature of the flaw (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained by the requirement for local access and the presence of a malformed DSDT table, which limits the practical attack surface primarily to specific hardware configurations (Feedly).

• Logs: Kernel panic messages referencing acpi_ns_get_next_node() or ACPICA namespace walking in /var/log/kern.log or dmesg output; NULL pointer dereference oops traces in system logs during boot.
• System Behavior: Unexpected system crashes or reboots during the ACPI initialization phase at boot time, particularly on systems with non-standard or vendor-specific BIOS/DSDT tables.
• Hardware Indicators: Systems with DMI string HONOR FMB-P/FMB-P-PCB and BIOS version 1.13 (05/08/2025) are confirmed affected hardware configurations.

Update to a patched Linux kernel version as soon as possible based on your distribution's maintenance stream. Fixed versions include: 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, and 6.18.3. Patch commits are available at git.kernel.org (e.g., 0d8bb08, 1bc3429, 7f9b951, 9d6c58d, b84edef, ecb2962, f91dad0). Azure Linux users running azl3_kernel_6.6.119.3-3 should update to a patched azl3_kernel package. After applying the patch, a system reboot is required to activate the fix. For systems that cannot be immediately patched, monitor for unexpected kernel panics during boot and verify BIOS/firmware integrity, particularly on Honor Magicbook hardware (Feedly, kernel.org patches).