{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2025-71095",
  "modified": "2026-10-07T17:22:01Z",
  "upstream": [
    "CVE-2025-71095"
  ],
  "published": "2026-01-13T15:35:54Z",
  "summary": "net: stmmac: fix the crash issue for zero copy XDP_TX action",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix the crash issue for zero copy XDP_TX action\n\nThere is a crash issue when running zero copy XDP_TX action, the crash\nlog is shown below.\n\n[  216.122464] Unable to handle kernel paging request at virtual address fffeffff80000000\n[  216.187524] Internal error: Oops: 0000000096000144 [#1]  SMP\n[  216.301694] Call trace:\n[  216.304130]  dcache_clean_poc+0x20/0x38 (P)\n[  216.308308]  __dma_sync_single_for_device+0x1bc/0x1e0\n[  216.313351]  stmmac_xdp_xmit_xdpf+0x354/0x400\n[  216.317701]  __stmmac_xdp_run_prog+0x164/0x368\n[  216.322139]  stmmac_napi_poll_rxtx+0xba8/0xf00\n[  216.326576]  __napi_poll+0x40/0x218\n[  216.408054] Kernel panic - not syncing: Oops: Fatal exception in interrupt\n\nFor XDP_TX action, the xdp_buff is converted to xdp_frame by\nxdp_convert_buff_to_frame(). The memory type of the resulting xdp_frame\ndepends on the memory type of the xdp_buff. For page pool based xdp_buff\nit produces xdp_frame with memory type MEM_TYPE_PAGE_POOL. For zero copy\nXSK pool based xdp_buff it produces xdp_frame with memory type\nMEM_TYPE_PAGE_ORDER0. However, stmmac_xdp_xmit_back() does not check the\nmemory type and always uses the page pool type, this leads to invalid\nmappings and causes the crash. Therefore, check the xdp_buff memory type\nin stmmac_xdp_xmit_back() to fix this issue.",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.160",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71095"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/3f7823219407f2f18044c2b72366a48810c5c821"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/4d0ceb7677e1c4616afb96abb4518f70b65abb0d"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/45ee0462b88396a0bd1df1991f801c89994ea72b"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/5e5988736a95b1de7f91b10ac2575454b70e4897"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a48e232210009be50591fdea8ba7c07b0f566a13"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T12:19:11Z"
  }
}