CVE-2025-71157 RDMA/core: always drop device refcount in ib_del_sub_device_and_put()
A missing reference count drop in the Linux kernel RDMA subsystem can lead to a null pointer dereference and system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-71157?
CVE-2025-71157 is a high-severity vulnerability in Linux kernel, published on 23 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: always drop device refcount in ib_del_sub_device_and_put()
Since nldev_deldev() (introduced by commit 060c642b2ab8 ("RDMA/nldev: Add support to add/delete a sub IB device through netlink") grabs a reference using ib_device_get_by_index() before calling ib_del_sub_device_and_put(), we need to drop that reference before returning -EOPNOTSUPP error.
Which versions are affected by CVE-2025-71157?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-71157?
Apply the vendor's patch.
Is CVE-2025-71157 being exploited?
There is no known exploitation of CVE-2025-71157 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-71157, DEBIAN-CVE-2025-71157, GHSA-x8q5-wjrh-hhx7, ROOT-OS-DEBIAN-13-CVE-2025-71157, UBUNTU-CVE-2025-71157.