CVE-2025-71096: Linux Kernel Information Disclosure Flaw

CVE-2025-71096 Overview

A vulnerability has been identified in the Linux kernel's RDMA (Remote Direct Memory Access) core subsystem. The flaw exists in the handling of netlink responses for RDMA_NL_LS_OP_IP_RESOLVE operations, where the LS_NLA_TYPE_DGID attribute presence is not properly validated. When userspace fails to provide the required DGID attribute to a kernel-initiated query, the system reads uninitialized memory from the stack, leading to potential information disclosure or system instability.

Critical Impact

Userspace-triggered uninitialized memory read in RDMA netlink handling can expose sensitive kernel stack data and potentially cause system crashes.

Affected Products

• Linux Kernel (RDMA/core subsystem)
• Systems utilizing InfiniBand RDMA functionality
• Linux distributions with RDMA kernel modules enabled

Discovery Timeline

• January 13, 2026 - CVE-2025-71096 published to NVD
• January 13, 2026 - Last updated in NVD database

Technical Details for CVE-2025-71096

Vulnerability Analysis

This vulnerability is classified as an Uninitialized Memory Use issue affecting the Linux kernel's RDMA core netlink handling. The flaw occurs in the ib_nl_handle_ip_res_resp function within drivers/infiniband/core/addr.c, where the kernel processes netlink responses for IP address resolution operations.

The root problem stems from improper validation of the LS_NLA_TYPE_DGID netlink attribute. When processing RDMA_NL_LS_OP_IP_RESOLVE responses, the kernel expects this attribute to always be present. However, the original implementation used a for-loop to search for the attribute without properly initializing the search result, allowing malformed userspace responses to trigger reads from uninitialized stack memory.

The KMSAN (Kernel Memory Sanitizer) bug report reveals the uninitialized value propagates through hex_byte_pack and ip6_string functions in the kernel's vsprintf implementation, ultimately reaching the printk subsystem when attempting to format IPv6 addresses for logging.

Root Cause

The vulnerability originates from inadequate netlink attribute parsing in the RDMA core subsystem. The original code used a manual for-loop to search for the LS_NLA_TYPE_DGID attribute within the netlink response, but failed to properly handle the case where the attribute was missing entirely. This resulted in the use of an uninitialized nlattrs array element when userspace provided a malformed response lacking the mandatory DGID attribute.

The fix replaces the manual search loop with the proper nla_parse_deprecated() API call, which correctly fills the nlattrs array and allows direct indexing to retrieve the DGID data. The corrected code now explicitly fails if the required attribute is NULL, preventing the uninitialized read condition.

Attack Vector

An attacker with local access and the ability to send netlink messages can craft malicious responses to kernel-initiated RDMA_NL_LS_OP_IP_RESOLVE queries. By omitting the required LS_NLA_TYPE_DGID attribute from the response, the attacker can trigger the kernel to read uninitialized stack memory.

The attack path follows the netlink message flow from userspace through netlink_sendmsg → netlink_unicast → rdma_nl_rcv → ib_nl_handle_ip_res_resp, where the uninitialized read occurs. The exposed stack data may contain sensitive kernel pointers or other privileged information that could aid further exploitation attempts.

Detection Methods for CVE-2025-71096

Indicators of Compromise

• KMSAN warnings in kernel logs referencing uninit-value in hex_byte_pack or ip6_string functions
• Unusual kernel panics or crashes originating from RDMA core or vsprintf subsystems
• Anomalous netlink traffic patterns targeting RDMA subsystem operations
• System instability when RDMA/InfiniBand services are in use

Detection Strategies

• Enable KMSAN (Kernel Memory Sanitizer) in development or testing environments to detect uninitialized memory access
• Monitor dmesg output for BUG reports related to uninit-value in the RDMA subsystem
• Implement audit logging for netlink socket operations, particularly those targeting the RDMA netlink family
• Deploy kernel integrity monitoring to detect exploitation attempts targeting memory disclosure vulnerabilities

Monitoring Recommendations

• Configure syslog alerting for KMSAN-related kernel warnings referencing drivers/infiniband/core/addr.c
• Monitor for unexpected netlink traffic to the RDMA netlink family from unprivileged processes
• Implement behavioral monitoring for processes accessing RDMA subsystem interfaces
• Track kernel version and patch status across affected systems to ensure remediation coverage

How to Mitigate CVE-2025-71096

Immediate Actions Required

• Update the Linux kernel to a patched version containing the security fix
• Review systems with InfiniBand or RDMA functionality enabled for potential exposure
• Restrict netlink socket access to trusted processes where operationally feasible
• Consider disabling RDMA functionality on systems where it is not required

Patch Information

The kernel development team has released patches that correct the netlink attribute parsing logic. The fix properly utilizes nla_parse_deprecated() to populate the nlattrs array and directly indexes the array to retrieve DGID data, failing gracefully when the required attribute is absent.

Multiple patch commits are available in the stable kernel trees:

• Kernel Git Commit 0b948af
• Kernel Git Commit 4553263
• Kernel Git Commit 9d85524
• Kernel Git Commit a7b8e87
• Kernel Git Commit acadd40

Workarounds

• Disable the RDMA/InfiniBand kernel modules if not required for production workloads using modprobe -r commands
• Restrict access to netlink sockets using security policies or namespace isolation
• Implement network segmentation to limit exposure of systems running RDMA services
• Apply kernel hardening options such as CONFIG_INIT_STACK_ALL to mitigate uninitialized memory access risks

# Disable RDMA kernel modules if not needed
modprobe -r rdma_cm
modprobe -r ib_core

# Blacklist RDMA modules to prevent automatic loading
echo "blacklist ib_core" >> /etc/modprobe.d/rdma-blacklist.conf
echo "blacklist rdma_cm" >> /etc/modprobe.d/rdma-blacklist.conf

# Verify modules are unloaded
lsmod | grep -E "(ib_core|rdma)"