CVE-2025-71131: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71131 is a use-after-free vulnerability in the Linux kernel's crypto/seqiv module, where the code incorrectly dereferences req->iv after calling crypto_aead_encrypt(). Since the underlying AEAD request may be freed by an asynchronous completion handler as soon as crypto_aead_encrypt() returns, this dereference is invalid and can lead to a denial of service. The vulnerability was published on January 14, 2026, and affects a wide range of Linux kernel versions dating back to 2.6.25, as well as Microsoft's Azure Linux 3 kernel package azl3_kernel_6.6.119.3-3. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, NVD).

The root cause is a use-after-free (UAF) condition in the seqiv (Sequence Number IV Generator) module within the Linux kernel's crypto subsystem. When crypto_aead_encrypt() is invoked, the underlying AEAD request structure — including req->iv — may be freed by an asynchronous completion callback before the calling code finishes using it. The seqiv code then dereferences the now-freed req->iv pointer to compare it against info, resulting in undefined behavior. The fix introduces a new local variable unaligned_info to capture the necessary pointer value before the encrypt call, eliminating the post-free access. Exploitation requires local access with low privileges and is triggered through asynchronous cryptographic operations (CWE classified as Insufficient Information by NVD, but functionally a UAF) (NVD, Feedly).

Successful exploitation of this vulnerability by a low-privileged local attacker can cause a kernel crash or system hang, resulting in a denial of service condition. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Affected systems span a broad range of Linux kernel versions across multiple long-term support branches, meaning the potential scope of impact is wide across Linux-based infrastructure (Feedly, NVD).

Patches are available across multiple Linux kernel stable branches. Administrators should upgrade to the following fixed versions or later: Linux kernel 5.10.248+, 5.15.198+, 6.1.160+, 6.6.120+, 6.12.64+, or 6.18.4+. Microsoft has also released an update for the affected azl3_kernel_6.6.119.3-3 package. For systems that cannot be patched immediately, restricting local user access and monitoring for unexpected kernel crashes or crypto-related errors in system logs is advised (Feedly, NVD).