CVE-2025-71124: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-71124 is a NULL pointer dereference vulnerability in the Linux kernel's DRM MSM A6xx GPU driver affecting the preemption handling code. The flaw was disclosed on January 14, 2026, and affects Linux kernel versions 6.13 through 6.18.2 (specifically 6.13.1–6.18.2) as well as 6.19 release candidates (rc1–rc8). It carries a CVSS v3.1 base score of 5.5 (Medium), reflecting a local attack vector with low privileges required and high availability impact (Feedly, NVD).

The vulnerability is classified as CWE-476 (NULL Pointer Dereference) and resides in the drm/msm/a6xx driver's preemption handling logic. Specifically, preempt_prepare_postamble() was called before validating that preempt_postamble_ptr is non-NULL; if the postamble memory allocation fails, the pointer is NULL and dereferencing it causes a kernel crash. Exploitation requires local access with low privileges — an attacker must be able to trigger the code path where the postamble allocation fails, leading to the dereference. The fix, tracked via Patchwork at freedesktop.org, reorders the call so the validity check precedes the function invocation (Feedly, NVD).

Successful exploitation causes a kernel crash, resulting in a denial of service (system unavailability). The impact is limited to availability — there is no confidentiality or integrity impact. Affected systems include those running Linux kernel 6.13.1 through 6.18.2 or 6.19 release candidates with Qualcomm Adreno A6xx GPU hardware, which is common in mobile and embedded platforms (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of writing. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term (Feedly).

The vulnerability is patched in Linux kernel version 6.18.3 and later. Two patch commits are available: 2c46497eb148ec61909f4101b8443f3c4c2daaec and ef3b04091fd8bc737dc45312375df8625b8318e2 on the stable kernel tree. Systems running affected versions (6.13.1–6.18.2 or 6.19-rc1 through rc8) should apply available kernel updates as soon as possible. As an interim measure, restricting local system access to trusted users only reduces exposure given the local attack vector (Feedly, NVD).