CVE-2025-71148: Linux Kernel Information Disclosure Flaw

CVE-2025-71148 Overview

A memory leak vulnerability has been identified in the Linux kernel's net/handshake subsystem. The handshake_req_submit() function replaces sk->sk_destruct during socket handshake operations but fails to restore it when submission fails before the request is hashed. This causes handshake_sk_destruct() to return early without executing the original destructor, resulting in socket memory leaks.

Critical Impact
Socket memory leak in Linux kernel handshake subsystem can lead to resource exhaustion and potential denial of service conditions on affected systems.

Affected Products

Linux kernel with net/handshake subsystem enabled
Linux kernel versions with affected handshake_req_submit() implementation
Systems utilizing kernel-level TLS/handshake operations

Discovery Timeline

2026-01-23 - CVE CVE-2025-71148 published to NVD
2026-01-26 - Last updated in NVD database

Technical Details for CVE-2025-71148

Vulnerability Analysis

This vulnerability exists within the Linux kernel's network handshake subsystem, specifically in the handshake_req_submit() function. When a handshake request is submitted, the kernel temporarily replaces the socket's destructor pointer (sk->sk_destruct) with handshake_sk_destruct() to handle cleanup operations specific to the handshake process.

The flaw occurs on the error path when submission fails before the request has been added to the hash table. In this scenario, the original socket destructor is never restored. When handshake_sk_destruct() is later called during socket cleanup, it checks whether the request was properly hashed. Finding that it wasn't, the function returns early without invoking the original destructor that was saved before replacement.

This leads to a memory leak where socket resources are never properly freed. Over time, repeated failures can exhaust kernel memory resources, potentially degrading system performance or causing denial of service conditions.

Root Cause

The root cause is improper error handling in the handshake_req_submit() function. The function modifies sk->sk_destruct to point to handshake_sk_destruct() early in the submission process but fails to restore the original destructor pointer when encountering errors before the request is successfully hashed. This violates the principle that resource modifications should be rolled back on failure paths.

Attack Vector

The attack vector for this vulnerability involves triggering repeated handshake submission failures that occur before request hashing. While the specific conditions required to trigger these failures depend on system configuration and network state, an attacker with the ability to influence handshake operations could potentially exploit this to cause resource exhaustion through accumulated memory leaks.

The vulnerability affects the kernel's internal socket management, meaning exploitation would require local access or the ability to trigger network handshake operations that fail in the specific window before hashing completes.

Detection Methods for CVE-2025-71148

Indicators of Compromise

Unexplained growth in kernel memory usage over time
Increasing socket allocation counts without corresponding deallocations
System log entries indicating handshake submission failures
Memory pressure warnings in kernel logs related to socket subsystem

Detection Strategies

Monitor kernel memory statistics for gradual increases in allocated socket structures
Implement alerting on repeated handshake failure events in system logs
Track socket allocation and deallocation patterns using kernel tracing tools like ftrace or perf
Use memory leak detection tools such as kmemleak to identify unreleased socket memory

Monitoring Recommendations

Enable kernel memory debugging options during investigation periods
Set up automated monitoring for socket subsystem memory metrics
Review system logs for patterns of handshake-related errors
Implement resource usage thresholds with alerting for early detection

How to Mitigate CVE-2025-71148

Immediate Actions Required

Update Linux kernel to a patched version containing the fix
Monitor systems for signs of memory exhaustion
Consider temporarily disabling or limiting handshake operations if actively exploited
Review system logs for evidence of exploitation attempts

Patch Information

The Linux kernel maintainers have released fixes across multiple kernel branches. The patch restores sk_destruct on the error path to ensure proper cleanup when handshake_req_submit() fails before the request is hashed.

Patches are available through the following kernel commits:

Workarounds

Limit exposure to untrusted network handshake operations where possible
Monitor and restart affected services if memory exhaustion symptoms appear
Implement resource limits to contain potential memory leak impact
Schedule regular system reboots as a temporary measure until patching is complete

bash

# Check current kernel version
uname -r

# Monitor socket memory usage
cat /proc/net/sockstat

# Check for memory pressure
dmesg | grep -i "memory\|oom"