CVE-2025-71129: 
CBL Mariner vulnerability analysis and mitigation

CVE-2025-71129 is a denial-of-service vulnerability in the Linux kernel's eBPF subsystem on LoongArch architecture, caused by improper sign extension of kfunc call arguments. Because kfunc calls are native calls that must follow LoongArch calling conventions, failing to sign-extend arguments can trigger a kernel panic. The vulnerability was published on January 14, 2026, and affects Linux kernel versions 6.1.1–6.6.119, 6.7–6.12.63, 6.13–6.18.3, and 6.19 release candidates (rc1–rc8). It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, NVD).

The root cause is insufficient argument handling in the LoongArch BPF JIT compiler: when eBPF programs invoke kernel functions (kfuncs) via native calls, the JIT does not properly sign-extend 32-bit arguments to 64-bit registers as required by the LoongArch ABI, leading to undefined behavior and kernel panic (classified as NVD-CWE-noinfo due to insufficient public detail). The fix introduces a new emit_abi_ext() helper that performs in-place sign extension on values already stored in the target register — distinct from the pre-existing sign_extend() helper, which cannot be reused for this purpose. Exploitation requires local access and the ability to load eBPF programs, making the attack vector local with low privileges required and no user interaction needed (Feedly, NVD).

Successful exploitation results in a kernel panic, causing a complete denial of service and system unavailability on affected LoongArch-based Linux systems. There is no confidentiality or integrity impact — the vulnerability is limited to availability. The scope is confined to the affected system, with no evidence of lateral movement potential (Feedly, NVD).

Patches have been published in the Linux kernel stable branches. Users should upgrade to kernel versions 6.6.120 or later (for the 6.1.1–6.6.x branch), 6.12.64 or later (for the 6.7–6.12.x branch), or 6.18.4 or later (for the 6.13–6.18.x branch). Microsoft has also released a patch for azl3_kernel_6.6.119.3-3. As a workaround, organizations should restrict the ability of low-privileged users to load eBPF programs (e.g., via kernel.unprivileged_bpf_disabled=1) until patching is complete (Feedly, kernel.org patch).