PT-2026-2607 · Linux+2 · Linux Kernel+2
Published
2025-12-22
·
Updated
2026-05-11
·
CVE-2025-71086
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The
rose kill by device() function in the Linux kernel incorrectly indexes an array, potentially leading to an out-of-bounds read or an invalid socket pointer dereference. The function collects sockets into a local array and iterates to disconnect sockets bound to a device. The error occurs because the loop uses an incorrect index (cnt) instead of the correct index (i). This can result in reading uninitialized memory or accessing memory outside the array bounds, potentially leaking socket references. The vulnerable function is rose kill by device().Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Improper Validation of Array Index
Stack Overflow
Use of Uninitialized Resource
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linuxmint
Linux Kernel
Ubuntu