CVE-2025-71270: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-71270 is a vulnerability in the Linux kernel affecting the LoongArch architecture's BPF JIT exception handling. Specifically, the architecture-specific trap handler do_ade() failed to call the common BPF exception fixup routine when ADEM (Address Error exception for Memory access) exceptions occurred during BPF_PROBE_MEM* instruction execution, preventing safe recovery from recoverable memory access errors. Affected kernel versions include 6.2 through 6.6.123, 6.7 through 6.12.69, 6.13 through 6.18.9, and release candidates 6.19-rc1 through rc3. It was disclosed on March 18, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an incomplete exception handling path in the LoongArch-specific do_ade() trap handler, which did not invoke the kernel's common BPF exception fixup routine (EX_TYPE_BPF) for ADEM subcodes triggered by BPF probe memory instructions. During JIT compilation, the kernel generates exception fixup table entries for BPF_PROBE_MEM* instructions to allow graceful recovery from illegal memory accesses; however, without the architecture-specific handler calling the fixup routine, these entries were never exercised on LoongArch, leaving BPF programs unable to recover from such faults. This is classified under improper error handling / missing exception handling logic. The fix modifies do_ade() to detect and dispatch BPF-related ADEM exceptions to the common fixup path (Red Hat Bugzilla, Kernel Patch).

On LoongArch systems, BPF programs using BPF_PROBE_MEM* instructions that encounter illegal memory addresses will trigger unrecoverable ADEM exceptions instead of being safely handled by the exception fixup mechanism. This results in a denial-of-service condition — the BPF program (and potentially the kernel context it runs in) fails ungracefully, impacting availability with no confidentiality or integrity impact. The scope is limited to LoongArch hardware running affected kernel versions with BPF programs performing memory probing operations (Red Hat Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The vulnerability requires local access with low privileges (e.g., ability to load BPF programs) and is limited to LoongArch architecture systems. The EPSS score is 0.018% (0.000180), indicating very low probability of exploitation in the near term. CVE-2025-71270 is not listed in the CISA Known Exploited Vulnerabilities catalog (Red Hat Advisory).

Update the Linux kernel to a patched version: 6.6.124 or later (for the 6.6 stable branch), 6.12.70 or later (for the 6.12 stable branch), or 6.18.10 or later (for the 6.18 branch). Patches are available in the upstream stable kernel repository. No configuration-based workaround is documented; upgrading to a fixed kernel version is the recommended remediation for LoongArch systems running BPF workloads (Kernel Patch, Red Hat Advisory).