UBUNTU-CVE-2025-71080
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT On PREEMPT_RT kernels, after rt6_get_pcpu_route() returns NULL, the current task can be preempted. Another task running on the same CPU may then execute rt6_make_pcpu_route() and successfully install a pcpu_rt entry. When the first task resumes execution, its cmpxchg() in rt6_make_pcpu_route() will fail because rt6i_pcpu is no longer NULL, triggering the BUG_ON(prev). It's easy to reproduce it by adding mdelay() after rt6_get_pcpu_route(). Using preempt_disable/enable is not appropriate here because ip6_rt_pcpu_alloc() may sleep. Fix this by handling the cmpxchg() failure gracefully on PREEMPT_RT: free our allocation and return the existing pcpu_rt installed by another task. The BUG_ON is replaced by WARN_ON_ONCE for non-PREEMPT_RT kernels where such races should not occur.
02 / AFFECTED SOFTWARE
Affected packages
11 explicit affected versions
50 explicit affected versions
6 explicit affected versions
9 explicit affected versions
11 explicit affected versions
1 explicit affected versions
12 explicit affected versions
19 explicit affected versions
6 explicit affected versions
24 explicit affected versions
10 explicit affected versions
26 explicit affected versions
7 explicit affected versions
13 explicit affected versions
35 explicit affected versions
42 explicit affected versions
18 explicit affected versions
13 explicit affected versions
4 explicit affected versions
23 explicit affected versions
1 explicit affected versions
21 explicit affected versions
16 explicit affected versions
10 explicit affected versions
15 explicit affected versions
8 explicit affected versions
7 explicit affected versions
12 explicit affected versions
7 explicit affected versions
12 explicit affected versions
14 explicit affected versions
1 explicit affected versions
7 explicit affected versions
11 explicit affected versions
12 explicit affected versions
12 explicit affected versions
36 explicit affected versions
38 explicit affected versions
10 explicit affected versions
37 explicit affected versions
13 explicit affected versions
10 explicit affected versions
59 explicit affected versions
26 explicit affected versions
13 explicit affected versions
29 explicit affected versions
13 explicit affected versions
12 explicit affected versions
33 explicit affected versions
23 explicit affected versions
10 explicit affected versions
11 explicit affected versions
12 explicit affected versions
4 explicit affected versions
7 explicit affected versions
12 explicit affected versions
10 explicit affected versions
26 explicit affected versions
13 explicit affected versions
16 explicit affected versions
3 explicit affected versions
7 explicit affected versions
51 explicit affected versions
18 explicit affected versions
37 explicit affected versions
12 explicit affected versions
3 explicit affected versions
27 explicit affected versions
8 explicit affected versions
5 explicit affected versions
8 explicit affected versions
10 explicit affected versions
7 explicit affected versions
41 explicit affected versions
13 explicit affected versions
13 explicit affected versions
7 explicit affected versions
8 explicit affected versions
10 explicit affected versions
12 explicit affected versions
9 explicit affected versions
31 explicit affected versions
44 explicit affected versions
16 explicit affected versions
3 explicit affected versions
13 explicit affected versions
26 explicit affected versions
45 explicit affected versions
37 explicit affected versions
14 explicit affected versions
38 explicit affected versions
9 explicit affected versions
11 explicit affected versions
7 explicit affected versions
4 explicit affected versions
1 explicit affected versions
83 explicit affected versions
13 explicit affected versions
43 explicit affected versions
10 explicit affected versions
8 explicit affected versions
14 explicit affected versions
4 explicit affected versions
78 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT On PREEMPT_RT kernels, after rt6_get_pcpu_route() returns NULL, the current task can be preempted. Another task running on the same CPU may then execute rt6_make_pcpu_route() and successfully install a pcpu_rt entry. When the first task resumes execution, its cmpxchg() in rt6_make_pcpu_route() will fail because rt6i_pcpu is no longer NULL, triggering the BUG_ON(prev). It's easy to reproduce it by adding mdelay() after rt6_get_pcpu_route(). Using preempt_disable/enable is not appropriate here because ip6_rt_pcpu_alloc() may sleep. Fix this by handling the cmpxchg() failure gracefully on PREEMPT_RT: free our allocation and return the existing pcpu_rt installed by another task. The BUG_ON is replaced by WARN_ON_ONCE for non-PREEMPT_RT kernels where such races should not occur.
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/1adaea51c61b52e24e7ab38f7d3eba023b2d050d
- https://git.kernel.org/stable/c/1adaea51c61b52e24e7ab38f7d3eba023b2d050d
- https://git.kernel.org/stable/c/1dc33ad0867325f8d2c6d7b2a6f542d4f3121f66
- https://git.kernel.org/stable/c/787515ccb2292f82eb0876993129154629a49651
- https://ubuntu.com/security/CVE-2025-71080
- https://ubuntu.com/security/notices/USN-8162-1
- https://ubuntu.com/security/notices/USN-8177-1
- https://ubuntu.com/security/notices/USN-8177-2
- https://ubuntu.com/security/notices/USN-8184-1
- https://ubuntu.com/security/notices/USN-8186-1
- https://ubuntu.com/security/notices/USN-8187-1
- https://ubuntu.com/security/notices/USN-8204-1
- https://ubuntu.com/security/notices/USN-8265-1
- https://www.cve.org/CVERecord?id=CVE-2025-71080