CVE-2025-71160: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71160 is a denial-of-service vulnerability in the Linux kernel's netfilter nf_tables subsystem caused by inefficient chain re-validation logic. When a local attacker crafts malicious netfilter rule chains with overlapping jump paths, the nft_chain_validate() function enters a CPU soft lockup state lasting 27+ seconds. Affected kernel versions include 4.18 through 6.6.120, 6.7 through 6.12.65, and 6.13 through 6.18.5, as well as 6.19-rc1. It was published on January 23, 2026, with patches analyzed by NIST on February 26, 2026. The CVSS v3.1 base score is 5.5 (Medium) (Red Hat Advisory, kernel.org patches).

The root cause is an algorithmic inefficiency (classified as NVD-CWE-noinfo / insufficient information) in nft_chain_validate(), which traverses the entire nf_tables chain graph from base chain entry points on every commit, re-validating previously checked chains unnecessarily. When multiple rules share overlapping jump paths (e.g., input → j2 → j3 appearing in multiple rules), the validator redundantly re-traverses already-validated sub-chains, causing exponential work and CPU soft lockups. The attack vector is local with low privileges required and no user interaction needed. The fix introduces memoization of validated chain states, tracking the base chain context (type, hooknum) and maximum observed call depth to skip re-validation where safe (Red Hat Advisory, kernel.org patches).

Successful exploitation causes severe denial-of-service conditions: CPU soft lockups lasting 27 seconds or more result in temporary system unresponsiveness and significant performance degradation. The impact is limited to availability — there is no confidentiality or integrity impact. Services dependent on normal kernel operation on the affected host may be disrupted, but the vulnerability does not enable lateral movement or data exfiltration (Red Hat Advisory, Feedly Intelligence).

1. Gain local access: Obtain a local account with low privileges on a system running a vulnerable Linux kernel version (4.18–6.6.120, 6.7–6.12.65, or 6.13–6.18.5).
2. Verify nf_tables availability: Confirm the nf_tables kernel module is loaded (lsmod | grep nf_tables) and that the user has permission to configure netfilter rules (e.g., via nft or iptables-nft).
3. Craft overlapping chain jump rules: Using the nft utility, create a ruleset with multiple base chain rules that reference shared sub-chains in overlapping paths, such as:
   • input → j2 → j3 (rule 1)
   • input → j2 → j3 (rule 2, duplicate)
   • input → j1 → j2 → j3 (rule 3)
4. Commit the ruleset: Apply the crafted ruleset with nft -f ruleset.nft, triggering nf_tables_commit() and the vulnerable nft_chain_validate() traversal.
5. Trigger CPU soft lockup: The validator redundantly re-traverses already-validated chains, causing the kernel watchdog to detect a CPU soft lockup (BUG: soft lockup - CPU stuck for 27s+), resulting in system unresponsiveness (Red Hat Advisory, kernel.org patches).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing watchdog: BUG: soft lockup - CPU#N stuck for 27s! with stack traces referencing nft_chain_validate, nft_immediate_validate, nft_table_validate, nf_tables_validate, and nf_tables_commit in the nf_tables module.
• Process: Presence of processes such as iptables-nft-restore or nft with high CPU utilization immediately before the lockup event.
• System: Sudden system unresponsiveness or watchdog-triggered kernel warnings coinciding with netfilter ruleset commits; audit logs showing nft or iptables-nft invocations by low-privilege local users.

Apply the available kernel patches, which are included in Linux kernel versions 6.6.121+, 6.12.66+, and 6.18.6+. Specific upstream fix commits are: 09d6074995c1, 14fa3d1927f1, 53de1e6cde8f, and 8e1a1bc4f5a4. Ubuntu has issued security notices USN-8278-1, USN-8278-2, USN-8289-1, USN-8289-2, and USN-8296-1/2 addressing this issue. As a workaround prior to patching, restrict local administrative access and limit which users can modify netfilter rules on production systems (Red Hat Advisory, Ubuntu USN-8278-1, kernel.org patches).

Red Hat tracked this vulnerability via Bugzilla (bug #2432392) and published a CVE advisory. Ubuntu issued multiple security notices (USN-8278-1/2, USN-8289-1/2, USN-8296-1/2) addressing the issue across various kernel flavors. Oracle also issued an enterprise kernel advisory (oracle-el-2026-50144). The vulnerability was reported by Hamza Mahfooz, who identified the CPU soft lockup behavior in nft_chain_validate(). Community coverage has been limited to standard vulnerability tracking channels with no significant social media discussion observed (Red Hat Advisory, Ubuntu USN-8278-1).