CVE-2025-71156: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71156 is a race condition vulnerability in the Linux kernel's Google Virtual Ethernet (GVE) driver that can cause a Denial of Service due to premature interrupt enabling before NAPI context initialization is complete. It was published on January 23, 2026, and affects Linux kernel versions 6.9 through 6.12.63, 6.13 through 6.18.3, and 6.19-rc1 through rc3. The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a race condition (classified as NVD-CWE-noinfo / insufficient information by NVD) in the GVE network driver's interrupt request handling. When an interrupt is requested, it is automatically enabled immediately via the default behavior, allowing it to fire before the associated NAPI (New API) polling context is fully initialized. This premature interrupt triggers __napi_poll and net_rx_action on an uninitialized NAPI context, leading to kernel failures. The fix applies the IRQF_NO_AUTOEN flag during interrupt registration and explicitly enables/disables the interrupt in sync with NAPI initialization and teardown, ensuring strict lifecycle coupling (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation of this vulnerability can result in a kernel-level Denial of Service, causing system instability or crashes on affected Linux hosts using the GVE driver. The GVE driver is primarily used in Google Cloud virtual machine environments, so the impact is scoped to virtualized Linux instances on that platform. While the CVSS score reflects high confidentiality, integrity, and availability impact (consistent with local privilege escalation potential), the primary documented consequence is a DoS due to the race condition during driver initialization (Red Hat Bugzilla, Red Hat Advisory).

The vulnerability is resolved in Linux kernel versions 6.12.64 and later (for the 6.9–6.12 branch) and 6.18.4 and later (for the 6.13–6.18 branch), with patches available in the stable kernel tree. Administrators running Google Cloud VMs with affected kernel versions should update to a patched kernel release. Three upstream patch commits address this issue: 3d970eda, 48f92776, and f5b7f49b (Red Hat Advisory, Red Hat Bugzilla).

Red Hat triaged this vulnerability at medium severity and opened a security response bug tracking remediation. The Yocto Project security mailing list also referenced this CVE in multiple security digests, indicating awareness in the embedded Linux community. No significant public researcher commentary or media coverage has been identified beyond standard vulnerability tracking (Red Hat Bugzilla).