CVE-2025-71133: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71133 is a stack-out-of-bounds read vulnerability in the Linux kernel's RDMA/irdma module, specifically in the irdma_net_event() function. The flaw was published on January 14, 2026, and affects multiple Linux kernel versions: 5.14 through 5.15.198, 5.16 through 6.1.160, 6.2 through 6.6.120, 6.7 through 6.12.64, 6.13 through 6.18.4, and release candidates of 6.19 (rc1–rc8). It carries a CVSS v3.1 base score of 7.1 (High) (Feedly, kernel.org via NVD).

The root cause is an out-of-bounds read (CWE-125) in irdma_net_event(), which dereferences the neigh->dev field from the ptr argument before validating that the network event type is NETEVENT_NEIGH_UPDATE. Other event types (e.g., those triggered by ICMPv6 redirect processing via rt6_do_redirect) pass pointers to structures smaller than struct neighbour, causing the function to read beyond the valid memory region on the stack. The fix moves the neigh->dev dereference inside the NETEVENT_NEIGH_UPDATE case branch, ensuring type validation occurs first. The bug is triggered via the kernel's network notifier chain and can be reached through IPv6 packet processing paths such as ndisc_redirect_rcv → icmpv6_rcv → tcp_v6_err → rt6_do_redirect (Feedly, kernel.org via NVD).

The primary impact is kernel instability: on debug kernels with KASAN enabled, the invalid read triggers a BUG: KASAN: stack-out-of-bounds report, potentially crashing the system. On production kernels, the out-of-bounds read may expose sensitive kernel stack memory (confidentiality impact) and can contribute to system instability or crashes (availability impact). There is no integrity impact, and lateral movement potential is limited given the local attack vector and the requirement for low-privilege access (Feedly, kernel.org via NVD).

• Logs: Kernel log entries containing BUG: KASAN: stack-out-of-bounds in irdma_net_event on debug kernels; KASAN reports referencing irdma_net_event+0x32e/0x3b0 [irdma].
• Process: Unexpected kernel worker crashes associated with kworker processes handling network events, particularly in workqueues such as events rt6_probe_deferred.
• Network: Anomalous ICMPv6 redirect packets (ndisc_redirect_rcv) directed at systems running the irdma module, which could trigger the vulnerable code path.

Apply kernel updates containing the fix for the affected version branch: upgrade to Linux kernel 5.15.198 or later, 6.1.160 or later, 6.6.120 or later, 6.12.64 or later, or 6.18.4 or later, depending on the deployed kernel series. Patches are available through the Linux kernel stable tree at multiple commits (kernel.org patches). As a temporary workaround for systems that cannot be patched immediately, disabling or unloading the irdma kernel module (if RDMA functionality is not required) will eliminate the attack surface. Monitor for KASAN warnings in kernel logs as an indicator of potential triggering (Feedly).