CVE-2025-71133: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-71133 Overview

CVE-2025-71133 is an out-of-bounds read vulnerability in the Linux kernel's RDMA/irdma driver. The vulnerability exists in the irdma_net_event() function, which improperly dereferences the neigh pointer before verifying the event type. When network events other than NETEVENT_NEIGH_UPDATE are received, the pointer may reference smaller structures, leading to invalid memory reads.

The flaw was identified through KASAN (Kernel Address SANitizer) on debug kernels, which flagged a stack-out-of-bounds read at irdma_net_event+0x32e/0x3b0. While the vulnerability is described as "mostly harmless" in the kernel patch notes, it represents improper memory access that could potentially be leveraged in more sophisticated attack chains.

Critical Impact
Improper memory access in the Linux kernel's RDMA/irdma driver could trigger kernel crashes on debug systems and may expose sensitive kernel memory information under specific conditions.

Affected Products

Linux kernel with RDMA/irdma driver enabled
Systems running kernel version 5.14.0-630.el9.x86_64+debug (confirmed affected)
Enterprise Linux distributions with irdma module loaded

Discovery Timeline

2026-01-14 - CVE-2025-71133 published to NVD
2026-01-19 - Last updated in NVD database

Technical Details for CVE-2025-71133

Vulnerability Analysis

The vulnerability stems from a failure to validate the event type before dereferencing the ptr parameter in the irdma_net_event() network event callback function. In the Linux kernel's network notifier system, different event types pass different structures through the generic ptr parameter. The NETEVENT_NEIGH_UPDATE event passes a struct neighbour, while other events may pass smaller structures or entirely different data types.

The problematic code accessed neigh->dev (where neigh is cast from ptr) before confirming the event was NETEVENT_NEIGH_UPDATE. When events such as rt6_do_redirect trigger the notifier chain, smaller structures are passed, and the read of neigh->dev extends beyond the actual structure boundaries, resulting in a stack-out-of-bounds read.

The KASAN report shows this occurs during IPv6 route operations, specifically in the rt6_probe_deferred workqueue when processing ICMPv6 redirect messages through the ndisc_redirect_rcv path.

Root Cause

The root cause is improper input validation in the irdma_net_event() function. The function assumes the ptr parameter always points to a struct neighbour and immediately dereferences it to access the dev member. However, the network event notifier system uses this same callback for multiple event types, each with its own data structure format.

The fix involves moving the neigh->dev dereference inside the NETEVENT_NEIGH_UPDATE case block, ensuring the pointer is only treated as a struct neighbour when the event type guarantees that structure is being passed.

Attack Vector

This vulnerability is triggered locally through the kernel's network event notification system. The attack vector involves:

The system receives an ICMPv6 packet that triggers an IPv6 route redirect
The ndisc_redirect_rcv() function processes the redirect
The redirect handling triggers rt6_do_redirect() which calls the network event notifier chain
The irdma_net_event() callback receives an event with a structure smaller than struct neighbour
The premature dereference of ptr as neigh->dev reads beyond the actual structure's memory bounds

While exploitability for privilege escalation or code execution is limited, the memory disclosure implications on production systems should be evaluated. The vulnerability requires the irdma kernel module to be loaded and active network traffic involving IPv6 routing.

The vulnerability manifests in the network event handling path within the irdma driver. The fix relocates the dereference of neigh->dev to occur only after event type validation. See the kernel git commit for technical implementation details.

Detection Methods for CVE-2025-71133

Indicators of Compromise

KASAN reports in kernel logs indicating stack-out-of-bounds reads in irdma_net_event
Kernel warning messages referencing irdma_net_event+0x32e/0x3b0 or similar offsets
System instability during IPv6 route operations or ICMPv6 redirect processing
Unexpected kernel oops or panics when RDMA operations coincide with network routing changes

Detection Strategies

Monitor kernel logs for KASAN violations referencing the irdma module
Deploy kernel debugging tools to capture memory access violations in RDMA subsystems
Use runtime kernel integrity checking to detect anomalous memory access patterns
Implement audit logging for irdma module operations and network event callbacks

Monitoring Recommendations

Enable KASAN on test/staging systems to proactively detect similar memory access issues
Monitor dmesg output for stack traces involving irdma_net_event and network notifier chains
Track ICMPv6 redirect activity rates that could indicate exploitation attempts
Implement alerting on kernel module crash events involving the irdma driver

How to Mitigate CVE-2025-71133

Immediate Actions Required

Update to a patched Linux kernel version that includes the irdma fix
If immediate patching is not possible, consider temporarily unloading the irdma module on non-RDMA systems
Review systems for evidence of exploitation using the detection methods above
Prioritize patching on systems with RDMA workloads and IPv6 networking enabled

Patch Information

Multiple kernel git commits address this vulnerability. The fix moves the neigh->dev read operation under the NETEVENT_NEIGH_UPDATE case statement to ensure proper event type validation before dereferencing.

Relevant patches are available from the kernel git repository:

Workarounds

Unload the irdma kernel module if RDMA functionality is not required: modprobe -r irdma
Blacklist the irdma module to prevent automatic loading on systems not using RDMA
Implement network segmentation to limit exposure of affected systems to untrusted IPv6 traffic
Monitor and restrict ICMPv6 redirect messages at the network perimeter

bash

# Temporary workaround: Unload irdma module if not in use
sudo modprobe -r irdma

# Blacklist irdma module to prevent automatic loading
echo "blacklist irdma" | sudo tee /etc/modprobe.d/blacklist-irdma.conf
sudo update-initramfs -u