CVE-2025-71201: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71201 is an out-of-bounds read vulnerability in the Linux kernel's netfs (network filesystem) subsystem, specifically in the read unlock handling for buffered reads. The flaw occurs when the read result collection runs ahead of subrequest completions, causing folios (memory pages) to be unlocked prematurely before zero-fill subrequests complete — particularly when a file's size does not align to a page boundary. Affected versions include Linux kernel 6.14 through 6.18.5, and release candidates 6.19-rc1 through 6.19-rc4. It was published on February 14, 2026, and carries a CVSS v3.1 base score of 7.1 (High), with patches available as of March 2026 (Feedly, Kernel Patch 1).

The root cause is classified as CWE-125 (Out-of-bounds Read). In the Linux kernel's netfs layer, when handling buffered reads for network filesystems, the result collection logic can advance past the current completion state of subrequests. Specifically, when a file's end-of-file (EOF) falls in the middle of a page (non-page-aligned size), the zero-fill (ZERO) subrequest responsible for clearing the tail of the last page may not yet have completed when the folio is unlocked. This race condition allows a local user to access memory-mapped file regions before the tail bytes are properly zeroed, exposing uninitialized or stale kernel memory. Systems using 9P filesystems are particularly susceptible due to their synchronous READ operation model, while AFS and CIFS are less affected due to asynchronous dispatch (Feedly).

A local attacker with low privileges can read sensitive uninitialized kernel memory or stale file contents that should have been zeroed out, resulting in information disclosure. The vulnerability is exploitable through memory-mapped file operations (mmap) followed by read operations on files with non-page-aligned sizes (e.g., 24,998 bytes). There is no integrity or availability impact reported; the primary risk is confidentiality loss of kernel memory or file data accessible to unprivileged local users (Feedly).

1. Gain local access: Obtain a low-privileged local user account on a system running Linux kernel 6.14–6.18.5 or 6.19-rc1 through rc4, ideally with access to a 9P-mounted network filesystem.
2. Identify a non-page-aligned file: Locate or create a file whose size does not align to a page boundary (e.g., a file of exactly 24,998 bytes on a 9P filesystem).
3. Memory-map the file: Use mmap() to map the target file into the process's address space, triggering the netfs buffered read path.
4. Trigger the race condition: Perform a read operation on the mapped region that causes the netfs result collection to run ahead of the zero-fill subrequest completion, unlocking the folio prematurely.
5. Read uninitialized memory: Access the tail region of the last mapped page before the ZERO subrequest completes, reading stale or uninitialized kernel memory that was not properly cleared (Feedly).

• Process Behavior: Unusual mmap() and read() system call patterns targeting files with non-page-aligned sizes on network filesystems (9P, NFS, etc.) from low-privileged processes.
• Logs: Kernel debug logs (if enabled) showing netfs_folio: read-unlock events occurring before corresponding ZERO TERM subrequest completions; look for cto values in netfs tracing that do not match expected file sizes.
• File System: Repeated access to small, non-page-aligned files on 9P-mounted filesystems by non-administrative users, particularly in automated or scripted patterns.

The vulnerability is fixed in Linux kernel version 6.18.6 and later, as well as in 6.19-rc5 and newer release candidates. Patch commits are available at the upstream kernel repository. Administrators should upgrade affected systems to kernel 6.18.6 or apply the referenced patches directly. As interim mitigations: restrict local user access to network filesystem mounts (especially 9P), limit mmap permissions where feasible via access controls, and monitor for unusual file read patterns. Systems not using network filesystems (9P, NFS, etc.) are at reduced risk (Feedly, Kernel Patch 1, Kernel Patch 2).