CVE-2025-71126: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71126 is a deadlock vulnerability in the Linux kernel's MPTCP (Multipath TCP) implementation that allows a low-privileged local attacker to trigger a kernel deadlock, resulting in a denial of service. The flaw was published on January 14, 2026, and affects multiple stable kernel branches including 6.1.149–6.1.159, 6.6.101–6.6.119, 6.12.40–6.12.63, 6.15.8+, 6.16.1–6.18.2, and 6.19-rc releases. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is improper locking (CWE-667): the MPTCP packet scheduler attempts to acquire fallback_lock recursively during packet reinjection. Specifically, when an MP_FAIL message is received and the infinite map has not yet been transmitted, __mptcp_retrans() holds fallback_lock and then calls __mptcp_try_fallback(), which attempts to acquire the same lock — creating a classic recursive deadlock. The deadlock was reported by Jakub and confirmed via kernel lockdep warnings on Linux 6.18.0-rc7, with the call chain involving mptcp_sendmsg → __mptcp_retrans → __mptcp_try_fallback (Feedly).

Successful exploitation causes a complete kernel deadlock, rendering the affected system fully unresponsive and requiring a hard reboot to recover. The impact is limited to availability (no confidentiality or integrity loss), but the denial of service affects all processes on the system attempting network operations through MPTCP. Any multi-user or shared system with MPTCP enabled and accessible to low-privileged local users is at risk (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of writing. The vulnerability requires local access with low privileges and MPTCP must be enabled on the target system. The EPSS score is approximately 0.018% (0.000180), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

Apply the available kernel patches for the affected stable branches: upgrade to 6.1.160+, 6.6.120+, 6.12.64+, 6.16.0 (from 6.15.8+), or 6.18.3+ as appropriate. Patches are available via the Linux stable tree (kernel patches). As a workaround, disable MPTCP support if it is not required in your environment (e.g., via sysctl net.mptcp.enabled=0). Prioritize patching systems with MPTCP enabled that are accessible to untrusted local users (Feedly).

SUSE issued a kernel security advisory (SUSE-2026-0962-1) addressing this and related kernel issues (Linux Security). Tenable's Nessus scanner added detection plugins (IDs 284793, 298112, 299777, 300556, 303406) for this CVE across multiple Linux distributions. The Yocto Project security mailing list also flagged the issue for embedded Linux maintainers. No notable independent researcher commentary or significant social media discussion has been observed.