CVE-2025-71139: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-71139 is a denial-of-service vulnerability in the Linux kernel's kexec implementation, specifically in the kimage_map_segment() function within kernel/kexec_core.c. It affects Linux kernel versions 6.17 through 6.18.3 and 6.19-rc1 through 6.19-rc8. The vulnerability was published on January 14, 2026, and received its initial NVD analysis on March 25, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, kernel.org).

The root cause lies in commit 07d24902977e ("kexec: enable CMA based contiguous allocation"), which introduced direct allocation of kexec target addresses in the Contiguous Memory Allocator (CMA) area to avoid memory copying during the kexec jump. When CMA-based allocation is used, no IND_SOURCE pages are created for the kexec segment; however, kimage_map_segment() unconditionally assumes IND_SOURCE pages exist and attempts to map them into a contiguous virtual address using vmap(), triggering a kernel warning. The fix involves detecting CMA-allocated IMA segments and using page_address() directly instead of attempting vmap(). The vulnerability is classified as CWE with insufficient information (NVD-CWE-noinfo), and exploitation requires local access with low privileges. The bug is only triggered when a CMA area is reserved in the kernel (e.g., via the cma= kernel command line option) (Feedly).

Successful exploitation causes a denial-of-service condition by triggering a kernel warning in kimage_map_segment() during kexec_file_load system calls, preventing successful kernel image loading and system reboot operations via kexec. There is no confidentiality or integrity impact — the vulnerability is limited to availability (CVSS A:H). Systems that rely on kexec for live kernel updates, disaster recovery, or controlled reboots are most at risk, as the flaw can leave them unable to perform these critical operations (Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access with low privileges and is only triggered on systems with a CMA area reserved (either by default or via the cma= kernel command line option). The EPSS score is approximately 0.018% (0.000180), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Feedly).

The primary remediation is to update the Linux kernel to version 6.18.4 or later, which includes the fix committed to the stable branch at git.kernel.org/stable/c/a3785ae5d334bb71d47a593d54c686a03fb9d136 and git.kernel.org/stable/c/a843e4155c83211c55b1b6cc17eab27a6a2c5b6f. Ubuntu has issued security notices USN-8277-1, USN-8277-2, USN-8310-1, and USN-8374-1 addressing this vulnerability. As a temporary workaround for systems that cannot immediately update, administrators can disable CMA allocation by removing or not setting the cma= kernel command line option, or avoid using kexec on affected kernel versions until patching is complete (Feedly, Ubuntu USN-8277-1).

Ubuntu issued multiple security notices (USN-8277-1, USN-8277-2, USN-8310-1, USN-8374-1) addressing this and related kernel vulnerabilities. Coverage has been limited to standard vulnerability tracking and Linux security advisory channels, with no notable researcher commentary or broader media attention, consistent with the vulnerability's moderate severity and narrow exploitation conditions (Ubuntu USN-8277-1, Ubuntu USN-8374-1).