PT-2026-8126 · Linux · Linux Kernel

Published 2025-01-01 · Updated 2026-04-20 · CVE-2025-71202

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw exists in the Linux kernel related to IOMMU and stale IOTLB entries within the kernel address space. The issue involves the need to invalidate IOTLB paging cache entries before freeing CPU kernel page table pages. This is addressed by introducing a new IOMMU interface to manage this flushing process, particularly within the x86 architecture when handling combined user and kernel page tables. The primary cause is linked to the vfree() function, which is frequently used and can be triggered by unprivileged users. While the primary problem is resolved, a rare case involving memory unplug of reserved memory at boot remains, but cannot be triggered by unprivileged users.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

AZL-77724

CVE-2025-71202

ECHO-AE63-CB63-5929

Affected Products

Linux Kernel

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71202.json · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-71202 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-71202 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-71202 · Security Note
• https://osv.dev/vulnerability/AZL-77724 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-71202 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-71202 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-13-CVE-2025-71202 · Vendor Advisory
• https://git.kernel.org/stable/c/9f0a7ab700f8620e433b05c57fbd26c92ea186d9 · Patch
• https://osv.dev/vulnerability/BELL-CVE-2025-71202 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-71202 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2025-71202 · Vendor Advisory
• https://git.kernel.org/stable/c/e37d5a2d60a338c5917c45296bac65da1382eda5 · Patch
• https://security-tracker.debian.org/tracker/CVE-2025-71202 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2025-71202 · Vendor Advisory