CVE-2025-71096

An uninitialized memory read flaw was found in the Linux kernel's RDMA netlink subsystem. When processing IP resolution responses (RDMA_NL_LS_OP_IP_RESOLVE), the code did not properly validate that the required LS_NLA_TYPE_DGID attribute was present. A malformed userspace netlink message missing this attribute causes the kernel to read uninitialized stack data, which is then printed to kernel logs.

Exploitation requires the ability to send RDMA netlink messages, which typically requires root or CAP_NET_ADMIN capability. The information leaked is limited to uninitialized stack contents printed in kernel logs as an IPv6 address. Systems without RDMA/InfiniBand hardware or configuration are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.