CVE-2025-71125: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71125 is a NULL pointer dereference vulnerability in the Linux kernel's tracing subsystem, specifically in the perf events registration path for synthetic events. Synthetic events lack a function to register perf events, causing tracepoint_add_func to be called with a NULL function pointer, triggering kernel warnings and potential system instability. The vulnerability was published on January 14, 2026, and affects Linux kernel versions from 4.17 through 6.19-rc8, including stable branches prior to 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, and 6.18.3. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, NVD).

The root cause is classified as CWE-476 (NULL Pointer Dereference): the kernel's synthetic event subsystem does not implement a perf event registration function, so when a user attempts to open a synthetic perf event via perf_event_open(), the call chain (perf_tp_event_init → perf_trace_event_init → synth_event_reg → tracepoint_probe_register → tracepoint_add_func) dereferences a NULL function pointer. The fix modifies the code to return -ENODEV instead of proceeding with the NULL pointer, causing perf to gracefully report "No such device" rather than triggering a kernel WARN_ON. Exploitation requires local access with low privileges (e.g., running perf record -e synthetic:futex_wait), and no special configuration is needed beyond having access to the perf_event_open syscall (NVD, Feedly).

Successful exploitation results in a kernel warning (WARN_ON) in tracepoint_add_func and potential system instability or crash, constituting a denial of service against the availability of perf tracing functionality. There is no confidentiality or integrity impact — the vulnerability is limited to availability (kernel stability). The attack is confined to the local system and does not enable lateral movement or data exfiltration (NVD, Feedly).

1. Identify a vulnerable system: Confirm the target is running a Linux kernel version between 4.17 and the patched versions (before 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, or 6.18.3).
2. Obtain local access with low privileges: The attacker must have a local user account with permission to invoke the perf_event_open syscall.
3. Trigger the vulnerable code path: Execute a command such as perf record -e synthetic:futex_wait to attempt registration of a synthetic perf event.
4. Observe the result: On a vulnerable kernel, this triggers a WARN_ON in tracepoint_add_func at kernel/tracepoint.c:175, potentially causing kernel instability or a crash, resulting in denial of service (NVD).

• Logs: Kernel log (dmesg) entries containing WARNING: kernel/tracepoint.c:175 at tracepoint_add_func or similar WARN_ON messages from the tracing subsystem.
• Logs: Call trace in kernel logs referencing synth_event_reg, perf_trace_event_init, perf_tp_event_init, and perf_event_alloc.
• Process: Unusual or repeated invocations of the perf utility by non-root users, particularly with -e synthetic: event specifiers.
• Logs: System log entries showing perf_event_open syscall failures with error code 19 (ENODEV) on patched systems, or kernel warnings on unpatched systems (NVD).

Apply the available kernel patches for the relevant stable branches: upgrade to Linux kernel 5.10.248 or later, 5.15.198 or later, 6.1.160 or later, 6.6.120 or later, 6.12.64 or later, or 6.18.3 or later. Microsoft has also released updates for Azure Linux 3 (kernel version 6.6.119.3-3). As a temporary workaround on systems that cannot be patched immediately, restrict unprivileged user access to the perf_event_open syscall (e.g., via kernel.perf_event_paranoid sysctl set to a restrictive value such as 3, or using seccomp policies). Monitor system logs for tracepoint-related kernel warnings as indicators of exploitation attempts (Feedly, NVD).