CVE-2025-71096

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly

The netlink response for RDMA_NL_LS_OP_IP_RESOLVE should always have a

LS_NLA_TYPE_DGID attribute, it is invalid if it does not.

Use the nl parsing logic properly and call nla_parse_deprecated() to fill

the nlattrs array and then directly index that array to get the data for

the DGID. Just fail if it is NULL.

Remove the for loop searching for the nla, and squash the validation and

parsing into one function.

Fixes an uninitialized read from the stack triggered by userspace if it

does not provide the DGID to a kernel initiated RDMA_NL_LS_OP_IP_RESOLVE

query.

BUG: KMSAN: uninit-value in hex_byte_pack include/linux/hex.h:13 [inline]

BUG: KMSAN: uninit-value in ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490

hex_byte_pack include/linux/hex.h:13 [inline]

ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490

ip6_addr_string+0x18a/0x3e0 lib/vsprintf

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References