CVE-2025-71147: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71147 is a memory leak vulnerability in the Linux kernel's TPM 2.0 trusted keys subsystem, specifically in the tpm2_load_cmd function. The function allocates a temporary blob indirectly via tpm2_key_decode but fails to free it in error/failure paths, leading to kernel memory exhaustion. It was published on January 23, 2026, and affects Linux kernel versions 5.13–5.15.197, 5.16–6.1.159, 6.2–6.6.119, 6.7–6.12.63, and 6.13–6.18.2. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In the tpm2_load_cmd function within the Linux kernel's KEYS/trusted subsystem, a temporary memory blob is allocated indirectly through tpm2_key_decode but is not properly released when the function encounters failure paths. The fix wraps the blob allocation with a cleanup helper to ensure automatic deallocation on all exit paths. Exploitation requires local access with low privileges (e.g., a standard user account) and no user interaction, making it accessible to any unprivileged local user on an affected system (Red Hat Advisory, Feedly).

Successful exploitation allows a low-privileged local attacker to progressively exhaust kernel memory by repeatedly triggering failures in tpm2_load_cmd, leading to denial of service through system performance degradation or crashes. There is no impact on confidentiality or integrity — the vulnerability is limited to availability. Systems actively using TPM 2.0 trusted keys functionality are most at risk (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024%, reflecting a very low probability of exploitation in the near term (Feedly).

Apply the upstream Linux kernel patches available across all affected stable branches. Fixed versions include: 5.15.198 or later, 6.1.160 or later, 6.6.120 or later, 6.12.64 or later, and 6.18.3 or later. Patches are available via the kernel stable tree and have been incorporated into downstream distributions including Amazon Linux 2 (kernel 5.15) and Microsoft CBL-Mariner. As a workaround where patching is not immediately possible, restrict local user access on systems using TPM 2.0 trusted keys and monitor for unusual kernel memory consumption patterns (Red Hat Advisory, Microsoft MSRC, Feedly).

Red Hat tracked this vulnerability and provided a CVSS assessment via their security advisory portal. Microsoft acknowledged the issue in their Security Response Center update guide, noting it affects their CBL-Mariner kernel builds. No notable researcher commentary or significant social media discussion has been observed, consistent with the low severity and limited exploitability of this memory leak (Red Hat Advisory, Microsoft MSRC).