CVE-2025-71155: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-71155 is a memory corruption vulnerability in the Linux kernel's KVM subsystem for s390 architecture, specifically in the gmap_helper_zap_one_page() function. Missing validation checks in this function can lead to out-of-bounds write conditions and memory corruption within a guest virtual machine under specific circumstances. The vulnerability was published on January 23, 2026, and affects Linux kernel versions 6.17.4 through before 6.18, and 6.18 through before 6.18.4. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-787 (Out-of-bounds Write): the gmap_helper_zap_one_page() function in the KVM s390 guest memory address (gmap) subsystem lacked several necessary boundary and state validation checks, allowing memory corruption in the guest under specific conditions. The attack vector is local, requiring low privileges, and targets the KVM hypervisor layer on IBM s390 (mainframe) systems. An attacker with access to a guest environment could trigger the flaw by inducing specific memory mapping operations that bypass the missing checks, resulting in out-of-bounds writes to guest memory. Patches were committed to the stable kernel tree as commits 2af2abbcbf8573100288e8f8aea2dab8a2a0ceb7 and 2f393c228cc519ddf19b8c6c05bf15723241aa96 (Red Hat Bugzilla).

Successful exploitation can result in high confidentiality, integrity, and availability impact within the guest environment, as an attacker can corrupt guest memory, potentially enabling unauthorized memory reads, data tampering, or denial of service within the affected VM. The scope is limited to the guest (S:U), meaning the vulnerability does not directly allow escape to the host hypervisor, but guest compromise is achievable. Systems running KVM-based virtualization on IBM s390 hardware with affected kernel versions are at risk (Red Hat Advisory).

There is no public proof-of-concept exploit available, and no evidence of in-the-wild exploitation has been observed as of the time of reporting. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges on an s390 KVM guest, limiting the practical attack surface (Red Hat Advisory).

Update the Linux kernel to version 6.18 or later (for the 6.17.x branch) or to version 6.18.4 or later (for the 6.18.x branch), which include the fixes in commits 2af2abbcbf8573100288e8f8aea2dab8a2a0ceb7 and 2f393c228cc519ddf19b8c6c05bf15723241aa96. Ubuntu has released security notices USN-8277-1, USN-8277-2, USN-8310-1, and USN-8374-1 addressing this vulnerability. No configuration-based workarounds are known; patching is the recommended remediation (Ubuntu USN-8277-1, Ubuntu USN-8374-1, Red Hat Bugzilla).

The vulnerability has received routine coverage from Linux security advisory aggregators and distribution vendors, including Ubuntu and Red Hat, with no notable researcher commentary or significant social media discussion observed. The fix was tracked through standard kernel stable release processes without broader public attention.