CVE-2025-71156
BaseFortify
Publication date: 2026-01-23
Last updated on: 2026-02-26
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.4 (exc) |
| linux | linux_kernel | From 6.9 (inc) to 6.12.64 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel involves the premature enabling of interrupts before the associated NAPI (New API) context is fully initialized. Interrupts are currently enabled automatically upon request, which can cause interrupts to fire too early and lead to failures such as kernel call trace errors. The fix defers interrupt enabling until after NAPI registration by using the IRQF_NO_AUTOEN flag to prevent automatic enabling and explicitly enabling interrupts during NAPI initialization, ensuring the interrupt lifecycle is properly synchronized with the readiness of the NAPI context.
How can this vulnerability impact me? :
This vulnerability can cause system instability or failures due to interrupts firing before the NAPI context is ready, potentially leading to kernel errors or crashes. This can affect network performance and reliability on systems running the vulnerable Linux kernel, possibly resulting in degraded service or downtime.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for kernel log messages indicating interrupt handling failures related to NAPI initialization. Specifically, look for call traces in the system logs similar to the example provided, which include __napi_poll, net_rx_action, handle_softirqs, and related interrupt functions. You can use commands like 'dmesg | grep -i irq' or 'journalctl -k | grep -i irq' to search for such interrupt-related errors in the kernel logs.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that the Linux kernel is updated to a version where the fix is applied. The fix involves deferring interrupt enabling until NAPI registration by using the IRQF_NO_AUTOEN flag when requesting interrupts, preventing automatic enabling. Interrupts should then be explicitly enabled during NAPI initialization and disabled during NAPI teardown, ensuring the interrupt lifecycle is coupled with the readiness of the NAPI context.