CVE-2025-71228: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-71228 is a Linux kernel vulnerability affecting LoongArch 32-bit platforms, where an incorrect protection_map[] configuration for VM_NONE/VM_SHARED virtual memory states causes pages to become non-present, triggering kernel page faults (Oops). The CVE was published on February 18, 2026, and has since been marked as Rejected by its CVE Numbering Authority (Red Hat Advisory). The estimated CVSS severity is Medium, with an EPSS score of 0.000180 (Feedly). Affected software is the Linux kernel on LoongArch 32-bit platforms (Red Hat Bugzilla).

The root cause is an incorrect protection_map[] configuration in the Linux kernel's LoongArch 32-bit architecture code (CWE classification: improper memory protection). On 32-bit LoongArch platforms, _PAGE_PROTNONE evaluates to 0, meaning that when a Virtual Memory Area (VMA) is set to VM_NONE or VM_SHARED, the affected pages are incorrectly marked as non-present. This misconfiguration leads to kernel page faults (Oops) when those VMA states are accessed (Red Hat Bugzilla). The upstream fix replaces _PAGE_PROTNONE with _PAGE_PRESENT in protection_map[] to ensure pages remain accessible (Red Hat Bugzilla).

Exploitation of this vulnerability can cause kernel page faults and system crashes (Oops) on LoongArch 32-bit Linux systems, resulting in denial of service and system instability. The impact is limited to systems running the Linux kernel on LoongArch 32-bit hardware; other architectures and 64-bit LoongArch platforms are not affected. There is no evidence of confidentiality or integrity impact — the primary risk is availability loss through kernel crashes (Red Hat Bugzilla, Red Hat Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2025-71228. The EPSS score is extremely low at 0.000180, reflecting minimal exploitation probability (Feedly). The CVE has also been marked as Rejected by its CVE Numbering Authority, further limiting its operational significance. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

A kernel patch is available that corrects protection_map[] for VM_NONE/VM_SHARED by replacing _PAGE_PROTNONE with _PAGE_PRESENT on LoongArch 32-bit platforms (Red Hat Bugzilla). Administrators running Linux on LoongArch 32-bit hardware should apply the upstream kernel fix as referenced in the upstream CVE announcement. Given the CVE has been rejected, users should monitor their Linux distribution's security advisories for any backported fixes or updated guidance.

Red Hat tracked this issue via Bugzilla and the upstream kernel CVE announcement mailing list, but no significant public commentary or media coverage was observed given the niche hardware platform affected and the subsequent CVE rejection (Red Hat Bugzilla, Red Hat Advisory).