CVE-2025-71132: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71132 is a broken interrupt-context handling vulnerability in the Linux kernel's smc91x network driver that causes workqueue state corruption on systems built with the PREEMPT_RT real-time preemption patch. The flaw was published on January 14, 2026, and affects Linux kernel versions 5.15 through 6.18.x across multiple stable branches, as well as Microsoft Azure Linux 3 kernel 6.6.119.3-3. It carries a CVSS v3.1 base score of 5.5 (Medium) with high availability impact (Feedly, NVD).

The root cause is an asymmetric IRQ handling bug in the smc91x Ethernet driver (classified as NVD-CWE-noinfo due to insufficient information, but functionally a concurrency/locking defect). Specifically, smc_special_trylock() disables IRQs unconditionally even on PREEMPT_RT systems, but smc_special_unlock() calls spin_unlock_irqrestore() without properly restoring IRQs in the PREEMPT_RT context. This causes rcu_read_unlock_bh() in __dev_queue_xmit() to fail to invoke rcu_read_unlock() via __local_bh_enable_ip() when current->softirq_disable_cnt reaches zero, resulting in a leaked atomic/RCU context and a kernel BUG: workqueue leaked atomic splat. The fix replaces smc_special_trylock() with spin_trylock_irqsave() to correctly manage IRQ state (NVD, Feedly).

Successful exploitation causes workqueue state corruption manifesting as kernel BUG: workqueue leaked atomic errors, leading to denial of service conditions including system hangs or instability on affected PREEMPT_RT-enabled systems. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Systems running real-time Linux kernels in embedded, industrial, or latency-sensitive production environments (including Microsoft Azure Linux 3) are most at risk (Feedly, NVD).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of this report (Feedly). The vulnerability requires local access with low privileges, limiting its attack surface. The EPSS score is approximately 0.018% (0.000180), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

• Logs: Kernel log messages containing BUG: workqueue leaked atomic, lock or RCU associated with kworker processes and mld_ifc_work workqueue function.
• Logs: Kernel stack traces referencing process_scheduled_works, worker_thread, and kthread in the context of the mld workqueue on PREEMPT_RT systems.
• Logs: Kernel messages showing RCU=0->1 state transitions indicating leaked RCU read-side critical sections.
• Process: Unexpected stalls or hangs in kworker threads on systems using the smc91x Ethernet driver with PREEMPT_RT enabled.

Apply the available stable kernel patches addressing this issue across the relevant branches. Patched versions include: 5.15.198 or later, 6.1.160 or later, 6.6.120 or later, 6.12.64 or later, and 6.18.4 or later. Microsoft issued a patch for Azure Linux 3 on January 16, 2026. Multiple upstream fixes are available via kernel.org stable trees. As a workaround where patching is not immediately possible, disabling the smc91x driver or avoiding PREEMPT_RT builds on affected hardware may mitigate the issue (Feedly, NVD).