CVE-2025-71080

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT

On PREEMPT_RT kernels, after rt6_get_pcpu_route() returns NULL, the

current task can be preempted. Another task running on the same CPU

may then execute rt6_make_pcpu_route() and successfully install a

pcpu_rt entry. When the first task resumes execution, its cmpxchg()

in rt6_make_pcpu_route() will fail because rt6i_pcpu is no longer

NULL, triggering the BUG_ON(prev). It's easy to reproduce it by adding

mdelay() after rt6_get_pcpu_route().

Using preempt_disable/enable is not appropriate here because

ip6_rt_pcpu_alloc() may sleep.

Fix this by handling the cmpxchg() failure gracefully on PREEMPT_RT:

free our allocation and return the existing pcpu_rt installed by

another task. The BUG_ON is replaced by WARN_ON_ONCE for non-PREEMPT_RT

kernels where such races should not occur.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References