CVE-2025-71157: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71157 is a reference counting flaw in the Linux kernel's RDMA/core subsystem, specifically in the ib_del_sub_device_and_put() function. The vulnerability arises because nldev_deldev() acquires a device reference via ib_device_get_by_index() before calling ib_del_sub_device_and_put(), but fails to release that reference when the function returns an -EOPNOTSUPP error. Affected kernel versions include 6.11 through 6.12.63 and 6.13 through 6.18.3, as well as release candidates 6.19-rc1 through 6.19-rc3. It was published on January 23, 2026, with patches released on February 26, 2026. The CVSS v3.1 base score is 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a resource management flaw (CWE classified as insufficient information by NVD) in the RDMA/core kernel module, where a device reference obtained via ib_device_get_by_index() in nldev_deldev() is not released on the error path that returns -EOPNOTSUPP from ib_del_sub_device_and_put(). This constitutes a reference count leak — each failed netlink-based sub IB device deletion operation leaves an unreleased reference, gradually exhausting RDMA device resources. Exploitation requires local access with low privileges and involves sending crafted netlink messages to trigger the error condition repeatedly. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction (Red Hat Bugzilla, Red Hat Advisory).

A local attacker with low privileges can repeatedly trigger the reference counting error via netlink operations, causing RDMA device references to accumulate without being freed. Over time, this exhausts available RDMA device resources, leading to denial of service conditions where legitimate RDMA operations fail. Systems relying on RDMA for high-performance networking or storage (e.g., HPC clusters, InfiniBand-connected storage) are particularly at risk. The CVSS scoring also reflects potential high confidentiality and integrity impacts (C:H/I:H/A:H), though the primary practical impact is availability disruption (Red Hat Bugzilla, Red Hat Advisory).

Update the Linux kernel to version 6.12.64 or later (for systems on the 6.11–6.12.x branch) or 6.18.4 or later (for systems on the 6.13–6.18.x branch). Three upstream patch commits are available: 20436f2, fa3c411, and fe8d456. As a pre-patch monitoring measure, administrators should watch for unexpected RDMA resource exhaustion or failures in RDMA operations as a potential indicator of exploitation attempts (Red Hat Bugzilla, Red Hat Advisory).