CVE-2025-71180: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71180 is a locking context violation in the Linux kernel's counter: interrupt-cnt driver that can allow a low-privileged local attacker to trigger a kernel panic (denial of service). The flaw was introduced when the interrupt_cnt_isr IRQ handler was registered with the IRQF_NO_THREAD flag while also attempting to acquire a spinlock_t, which violates kernel locking semantics detected by CONFIG_PROVE_RAW_LOCK_NESTING. It affects Linux kernel versions from 5.13 through multiple stable branches up to (but not including) the patched releases. Published on January 31, 2026, it carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory).

The root cause is an incompatible locking context (CWE-667: Improper Locking) in the interrupt-cnt driver within the Linux kernel's counter subsystem. The interrupt_cnt_isr handler is marked IRQF_NO_THREAD, meaning it runs in hard-IRQ context, but it calls counter_push_event() which attempts to acquire a regular spinlock_t (events_list_lock). This combination is invalid: IRQF_NO_THREAD handlers must not acquire spinlock_t locks that could be held in threaded or process context, as CONFIG_PROVE_RAW_LOCK_NESTING detects and reports a "BUG: Invalid wait context" condition. The fix removes the IRQF_NO_THREAD flag rather than converting all nested locks to raw_spinlock_t, which would have imposed broader constraints on the locking hierarchy (Red Hat Advisory).

Successful exploitation causes a kernel panic, resulting in a denial of service — the affected system becomes unstable or crashes entirely. The impact is limited to availability (no confidentiality or integrity impact), and exploitation requires local access with low privileges. There is no evidence of lateral movement potential or data exposure risk associated with this vulnerability (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of writing (Red Hat Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term.

The vulnerability has been resolved in the following patched Linux kernel versions: 5.15.198, 6.1.161, 6.6.121, 6.12.66, and 6.18.6. Administrators should update to the appropriate patched version for their distribution as soon as possible. As an interim measure, limiting local user access on systems running vulnerable kernel versions can reduce exposure. Red Hat has issued advisory information via Bugzilla, and Ubuntu has released corresponding security notices (USN-8278-1, USN-8289-1, USN-8296-1, and their follow-up variants) (Red Hat Advisory, Ubuntu USN-8278-1).