CVE-2025-71133: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-71133 Overview

CVE-2025-71133 is an out-of-bounds read vulnerability in the Linux kernel's RDMA/irdma driver. The vulnerability exists in the irdma_net_event() function, which improperly dereferences the neigh pointer before verifying the event type. When network events other than NETEVENT_NEIGH_UPDATE are received, the pointer may reference smaller structures, leading to invalid memory reads.

The flaw was identified through KASAN (Kernel Address SANitizer) on debug kernels, which flagged a stack-out-of-bounds read at irdma_net_event+0x32e/0x3b0. While the vulnerability is described as "mostly harmless" in the kernel patch notes, it represents improper memory access that could potentially be leveraged in more sophisticated attack chains.

Critical Impact

Improper memory access in the Linux kernel's RDMA/irdma driver could trigger kernel crashes on debug systems and may expose sensitive kernel memory information under specific conditions.

Affected Products

• Linux kernel with RDMA/irdma driver enabled
• Systems running kernel version 5.14.0-630.el9.x86_64+debug (confirmed affected)
• Enterprise Linux distributions with irdma module loaded

Discovery Timeline

• 2026-01-14 - CVE-2025-71133 published to NVD
• 2026-01-19 - Last updated in NVD database

Technical Details for CVE-2025-71133

Vulnerability Analysis

The vulnerability stems from a failure to validate the event type before dereferencing the ptr parameter in the irdma_net_event() network event callback function. In the Linux kernel's network notifier system, different event types pass different structures through the generic ptr parameter. The NETEVENT_NEIGH_UPDATE event passes a struct neighbour, while other events may pass smaller structures or entirely different data types.

The problematic code accessed neigh->dev (where neigh is cast from ptr) before confirming the event was NETEVENT_NEIGH_UPDATE. When events such as rt6_do_redirect trigger the notifier chain, smaller structures are passed, and the read of neigh->dev extends beyond the actual structure boundaries, resulting in a stack-out-of-bounds read.

The KASAN report shows this occurs during IPv6 route operations, specifically in the rt6_probe_deferred workqueue when processing ICMPv6 redirect messages through the ndisc_redirect_rcv path.

Root Cause

The root cause is improper input validation in the irdma_net_event() function. The function assumes the ptr parameter always points to a struct neighbour and immediately dereferences it to access the dev member. However, the network event notifier system uses this same callback for multiple event types, each with its own data structure format.

The fix involves moving the neigh->dev dereference inside the NETEVENT_NEIGH_UPDATE case block, ensuring the pointer is only treated as a struct neighbour when the event type guarantees that structure is being passed.

Attack Vector

This vulnerability is triggered locally through the kernel's network event notification system. The attack vector involves:

1. The system receives an ICMPv6 packet that triggers an IPv6 route redirect
2. The ndisc_redirect_rcv() function processes the redirect
3. The redirect handling triggers rt6_do_redirect() which calls the network event notifier chain
4. The irdma_net_event() callback receives an event with a structure smaller than struct neighbour
5. The premature dereference of ptr as neigh->dev reads beyond the actual structure's memory bounds

While exploitability for privilege escalation or code execution is limited, the memory disclosure implications on production systems should be evaluated. The vulnerability requires the irdma kernel module to be loaded and active network traffic involving IPv6 routing.

The vulnerability manifests in the network event handling path within the irdma driver. The fix relocates the dereference of neigh->dev to occur only after event type validation. See the kernel git commit for technical implementation details.

Detection Methods for CVE-2025-71133

Indicators of Compromise

• KASAN reports in kernel logs indicating stack-out-of-bounds reads in irdma_net_event
• Kernel warning messages referencing irdma_net_event+0x32e/0x3b0 or similar offsets
• System instability during IPv6 route operations or ICMPv6 redirect processing
• Unexpected kernel oops or panics when RDMA operations coincide with network routing changes

Detection Strategies

• Monitor kernel logs for KASAN violations referencing the irdma module
• Deploy kernel debugging tools to capture memory access violations in RDMA subsystems
• Use runtime kernel integrity checking to detect anomalous memory access patterns
• Implement audit logging for irdma module operations and network event callbacks

Monitoring Recommendations

• Enable KASAN on test/staging systems to proactively detect similar memory access issues
• Monitor dmesg output for stack traces involving irdma_net_event and network notifier chains
• Track ICMPv6 redirect activity rates that could indicate exploitation attempts
• Implement alerting on kernel module crash events involving the irdma driver

How to Mitigate CVE-2025-71133

Immediate Actions Required

• Update to a patched Linux kernel version that includes the irdma fix
• If immediate patching is not possible, consider temporarily unloading the irdma module on non-RDMA systems
• Review systems for evidence of exploitation using the detection methods above
• Prioritize patching on systems with RDMA workloads and IPv6 networking enabled

Patch Information

Multiple kernel git commits address this vulnerability. The fix moves the neigh->dev read operation under the NETEVENT_NEIGH_UPDATE case statement to ensure proper event type validation before dereferencing.

Relevant patches are available from the kernel git repository:

• Kernel Git Commit Fix
• Kernel Git Commit Patch
• Kernel Git Commit Update
• Kernel Git Commit Improvement
• Kernel Git Commit Change
• Kernel Git Commit Revision

Workarounds

• Unload the irdma kernel module if RDMA functionality is not required: modprobe -r irdma
• Blacklist the irdma module to prevent automatic loading on systems not using RDMA
• Implement network segmentation to limit exposure of affected systems to untrusted IPv6 traffic
• Monitor and restrict ICMPv6 redirect messages at the network perimeter

# Temporary workaround: Unload irdma module if not in use
sudo modprobe -r irdma

# Blacklist irdma module to prevent automatic loading
echo "blacklist irdma" | sudo tee /etc/modprobe.d/blacklist-irdma.conf
sudo update-initramfs -u