CVE-2025-71080

ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT

published January 13, 2026

CVSS
—
EPSS
0%
Percentile
22.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT

On PREEMPT_RT kernels, after rt6_get_pcpu_route() returns NULL, the

current task can be preempted. Another task running on the same CPU

may then execute rt6_make_pcpu_route() and successfully install a

pcpu_rt entry. When the first task resumes execution, its cmpxchg()

in rt6_make_pcpu_route() will fail because rt6i_pcpu is no longer

NULL, triggering the BUG_ON(prev). It's easy to reproduce it by adding

mdelay() after rt6_get_pcpu_route().

Using preempt_disable/enable is not appropriate here because

ip6_rt_pcpu_alloc() may sleep.

Fix this by handling the cmpxchg() failure gracefully on PREEMPT_RT:

free our allocation and return the existing pcpu_rt installed by

another task. The BUG_ON is replaced by WARN_ON_ONCE for non-PREEMPT_RT

kernels where such races should not occur.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00304 · 22.0th percentile
Published
2026-01-13T15:34Z
EPSS history
Timeline
  • 13 JAN 15:34Z
    ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT
    cvelistv5