CVE-2025-71131: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71131 is a use-after-free vulnerability in the Linux kernel's crypto/seqiv module, where the code incorrectly dereferences req->iv after calling crypto_aead_encrypt(). Since the underlying AEAD request may be freed by an asynchronous completion handler as soon as crypto_aead_encrypt() returns, this dereference is invalid and can lead to a denial of service. The vulnerability was published on January 14, 2026, and affects a wide range of Linux kernel versions dating back to 2.6.25, as well as Microsoft's Azure Linux 3 kernel package azl3_kernel_6.6.119.3-3. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, NVD).

The root cause is a use-after-free (UAF) condition in the seqiv (Sequence Number IV Generator) module within the Linux kernel's crypto subsystem. When crypto_aead_encrypt() is invoked, the underlying AEAD request structure — including req->iv — may be freed by an asynchronous completion callback before the calling code finishes using it. The seqiv code then dereferences the now-freed req->iv pointer to compare it against info, resulting in undefined behavior. The fix introduces a new local variable unaligned_info to capture the necessary pointer value before the encrypt call, eliminating the post-free access. Exploitation requires local access with low privileges and is triggered through asynchronous cryptographic operations (CWE classified as Insufficient Information by NVD, but functionally a UAF) (NVD, Feedly).

Successful exploitation of this vulnerability by a low-privileged local attacker can cause a kernel crash or system hang, resulting in a denial of service condition. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Affected systems span a broad range of Linux kernel versions across multiple long-term support branches, meaning the potential scope of impact is wide across Linux-based infrastructure (Feedly, NVD).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018%, indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, further limiting the practical attack surface.

Patches are available across multiple Linux kernel stable branches. Administrators should upgrade to the following fixed versions or later: Linux kernel 5.10.248+, 5.15.198+, 6.1.160+, 6.6.120+, 6.12.64+, or 6.18.4+. Microsoft has also released an update for the affected azl3_kernel_6.6.119.3-3 package. For systems that cannot be patched immediately, restricting local user access and monitoring for unexpected kernel crashes or crypto-related errors in system logs is advised (Feedly, NVD).