CVE-2025-71135: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71135 is a NULL pointer dereference vulnerability in the Linux kernel's RAID5 subsystem, specifically within the raid5_store_group_thread_cnt() function. It affects Linux kernel versions 6.12.4 through 6.12.63, 6.13.1 through 6.18.3, and 6.13 base, as well as 6.19 release candidates (rc1–rc8). The vulnerability was published on January 14, 2026, with NVD analysis completed on March 25, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, kernel.org Patch).

The root cause is a NULL pointer dereference (CWE-476) in raid5_store_group_thread_cnt(). The function assigns mddev->private to a local conf variable and checks if it is NULL, but then proceeds to call raid5_quiesce(mddev, true) and raid5_quiesce(mddev, false) even when conf is NULL. Inside raid5_quiesce(), mddev->private is re-assigned to conf and subsequently dereferenced (e.g., conf->quiesce = 0, wake_up(&conf->wait_for_quiescent)), causing a kernel panic. The fix follows the pattern used in raid5_change_consistency_policy(): unlock mddev and return early when conf is NULL, before invoking raid5_quiesce(). Exploitation requires local access with low privileges, typically via writing to the relevant sysfs attribute for a RAID5 device (Feedly).

Successful exploitation results in a kernel NULL pointer dereference, leading to a kernel panic or system crash — a denial of service (DoS) condition. There is no impact on confidentiality or data integrity; the sole consequence is loss of availability. Systems running RAID5 configurations on affected kernel versions are at risk of forced downtime if a local attacker or unprivileged user can write to the relevant sysfs interface (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. Exploitation requires local access with low privileges, limiting the practical attack surface (Feedly).

Update the Linux kernel to version 6.12.64 or later, or 6.18.4 or later, where the vulnerability has been patched via three commits to the stable kernel tree. If immediate patching is not feasible, restrict local user access to sysfs RAID5 configuration attributes (e.g., /sys/block/mdX/md/group_thread_cnt) through filesystem permissions and access controls to reduce exposure. Monitor systems running vulnerable kernel versions for unexpected kernel panics or crashes related to RAID5 operations (Feedly, kernel.org Patch).