CVE-2025-71148: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71148 is a socket resource leak vulnerability in the Linux kernel's net/handshake subsystem, caused by a failure to restore the socket destructor on submission error paths. When handshake_req_submit() fails before the request is hashed, it leaves sk->sk_destruct replaced with handshake_sk_destruct(), which returns early and prevents the original destructor from running — resulting in a socket leak. The vulnerability was published on January 23, 2026, and affects Linux kernel versions 6.4–6.6.x (before 6.6.120), 6.7–6.12.x (before 6.12.64), and 6.13–6.18.x (before 6.18.3), as well as 6.19-rc1. It carries a CVSS v3.1 base score of 3.3 (Low) (Red Hat Advisory, Feedly).

The root cause is an improper error-path handling in handshake_req_submit() within the Linux kernel's net/handshake subsystem (classified as NVD-CWE-noinfo due to insufficient public detail). The function replaces sk->sk_destruct with its own handshake_sk_destruct() callback, but when submission fails prior to the request being added to the hash table, the original destructor pointer is never restored. As a result, handshake_sk_destruct() returns early on cleanup, bypassing the original destructor and leaking the socket object. Exploitation requires local access with low privileges (PR:L), and no user interaction is needed (Red Hat Advisory, Feedly).

The primary consequence of this vulnerability is a kernel-level socket resource leak, where accumulated leaked sockets can exhaust kernel memory over time, potentially leading to denial-of-service conditions on affected systems. The CVSS assessment also notes a low confidentiality impact, suggesting limited potential for information exposure through the leaked socket structures. The vulnerability is locally scoped with no integrity or availability impact assessed at the individual exploit level, though repeated triggering could degrade system stability (Feedly, Red Hat Advisory).

Apply the appropriate Linux kernel update for your version branch: upgrade to 6.6.120 or later (for 6.4–6.6.x), 6.12.64 or later (for 6.7–6.12.x), or 6.18.3 or later (for 6.13–6.18.x). Patches are available via the Linux kernel stable branches and have been referenced in Red Hat's Bugzilla (Red Hat Bugzilla) and upstream kernel commits (kernel.org patch 1, kernel.org patch 2). As an interim measure on unpatched systems, consider restricting local user access and monitoring for abnormal socket usage patterns that may indicate repeated exploitation attempts (Feedly).