CVE-2025-71078: Linux Kernel Privilege Escalation Flaw

CVE-2025-71078 Overview

CVE-2025-71078 is a kernel vulnerability in the Linux kernel's PowerPC 64-bit architecture affecting the Segment Lookaside Buffer (SLB) management during context switches. The vulnerability occurs in systems using the hash Memory Management Unit (MMU), where a software SLB preload cache mirrors entries loaded into the hardware SLB buffer. Due to improper synchronization between the hardware SLB and software preload cache during process migration between CPUs, stale SLB entries can persist and cause SLB multi-hit errors when the kernel attempts to reload evicted entries.

Critical Impact

This vulnerability can cause kernel panics due to SLB multi-hit errors when processes migrate between CPUs without proper MMU context switching, potentially leading to system instability and denial of service on PowerPC 64-bit systems.

Affected Products

• Linux kernel on PowerPC 64-bit systems with hash MMU
• Systems running affected kernel versions prior to the security patches

Discovery Timeline

• 2026-01-13 - CVE CVE-2025-71078 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-71078

Vulnerability Analysis

This vulnerability stems from a race condition in the Linux kernel's PowerPC SLB management subsystem. The SLB is a hardware cache that stores segment table entries for address translation on PowerPC 64-bit systems using the hash MMU. To optimize performance, the kernel maintains a software preload cache that mirrors the hardware SLB entries.

The issue arises during context switches when the kernel skips the switch_mmu_context() function in switch_mm_irqs_off() if the previous and next mm_struct are identical. While this optimization improves performance, it creates a synchronization gap on hash MMU systems where the hardware SLB and software preload cache can become inconsistent.

When a process migrates between CPUs, if an SLB entry is evicted from the software cache on one CPU and the same process later runs on another CPU without executing switch_mmu_context(), the hardware SLB may retain stale entries. Subsequently, when the kernel attempts to reload that entry through preload_new_slb_context(), it adds the entry to both the software preload cache and the hardware SLB. Since the entry was never invalidated on the destination CPU, this results in duplicate entries triggering an SLB multi-hit error.

Root Cause

The root cause is the lack of synchronization between the hardware SLB and software preload cache when processes migrate between CPUs without a full MMU context switch. The kernel's optimization to skip switch_mmu_context() when prev and next mm_struct pointers are identical does not account for the state divergence that can occur across different CPUs on hash MMU systems. Specifically, the periodic eviction of SLB entries (typically after every 256 context switches) on one CPU is not reflected in the hardware SLB state on other CPUs where the same process may subsequently execute.

Attack Vector

This is a local vulnerability that can be triggered during normal system operation when processes are migrated between CPUs by the scheduler. The conditions for triggering include:

1. A process running on a PowerPC 64-bit system with hash MMU
2. SLB entry eviction occurring on one CPU due to the preload cache aging mechanism
3. The process being migrated to another CPU
4. Context switch optimization skipping switch_mmu_context() because the mm_struct remains the same
5. Subsequent attempt to reload the evicted SLB entry, causing a multi-hit error

The vulnerability is not directly exploitable for privilege escalation but can cause denial of service through kernel panics. The complex timing requirements and dependency on scheduler behavior make intentional exploitation difficult, though the issue can manifest during normal workloads on affected systems.

Detection Methods for CVE-2025-71078

Indicators of Compromise

• Kernel panic messages indicating SLB multi-hit errors on PowerPC 64-bit systems
• System instability or unexpected reboots on PowerPC servers running hash MMU configurations
• Kernel log entries showing slb_machine_check or similar SLB-related error handlers being invoked

Detection Strategies

• Monitor kernel logs for SLB-related error messages using dmesg or centralized log collection
• Implement kernel crash dump analysis to identify SLB multi-hit exceptions in post-mortem analysis
• Use performance monitoring counters on PowerPC systems to track SLB-related events and anomalies

Monitoring Recommendations

• Enable kdump or similar crash dump mechanisms to capture kernel state during SLB errors
• Configure alerting on kernel panic events specifically on PowerPC 64-bit systems
• Monitor process migration patterns using scheduler tracing to identify workloads that may trigger the vulnerability

How to Mitigate CVE-2025-71078

Immediate Actions Required

• Apply the official Linux kernel patches to systems running PowerPC 64-bit with hash MMU configurations
• Schedule maintenance windows for kernel updates on production PowerPC servers
• Prioritize patching for systems with high process migration rates or multi-socket configurations

Patch Information

Multiple patches have been released to address this vulnerability in the Linux kernel stable branches. The fix modifies the SLB handling logic to properly synchronize the hardware SLB and software preload cache during context switches, even when the mm_struct remains the same. Patches are available at the following kernel.org commits:

• Linux Kernel Patch 00312419
• Linux Kernel Patch 4ae1e46d
• Linux Kernel Patch 895123c3
• Linux Kernel Patch b13a3dbf
• Linux Kernel Patch c9f86502

System administrators should update to kernel versions containing these patches through their distribution's package management system.

Workarounds

• Consider CPU affinity settings to reduce process migration frequency as a temporary measure
• Evaluate workload placement to minimize context switches across CPUs on critical PowerPC systems
• Monitor system stability closely and prepare for rapid patching if SLB errors are observed

# Check current kernel version on PowerPC systems
uname -r
uname -m

# Review kernel logs for SLB-related errors
dmesg | grep -i slb

# Check if system uses hash MMU (vulnerability only affects hash MMU systems)
cat /proc/cpuinfo | grep -i mmu