GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-71087 (GCVE-0-2025-71087)

Vulnerability from cvelistv5 – Published: 2026-01-13 15:34 – Updated: 2026-06-11 18:44
VLAI
Title
iavf: fix off-by-one issues in iavf_config_rss_reg()
Summary
In the Linux kernel, the following vulnerability has been resolved: iavf: fix off-by-one issues in iavf_config_rss_reg() There are off-by-one bugs when configuring RSS hash key and lookup table, causing out-of-bounds reads to memory [1] and out-of-bounds writes to device registers. Before commit 43a3d9ba34c9 ("i40evf: Allow PF driver to configure RSS"), the loop upper bounds were: i <= I40E_VFQF_{HKEY,HLUT}_MAX_INDEX which is safe since the value is the last valid index. That commit changed the bounds to: i <= adapter->rss_{key,lut}_size / 4 where `rss_{key,lut}_size / 4` is the number of dwords, so the last valid index is `(rss_{key,lut}_size / 4) - 1`. Therefore, using `<=` accesses one element past the end. Fix the issues by using `<` instead of `<=`, ensuring we do not exceed the bounds. [1] KASAN splat about rss_key_size off-by-one BUG: KASAN: slab-out-of-bounds in iavf_config_rss+0x619/0x800 Read of size 4 at addr ffff888102c50134 by task kworker/u8:6/63 CPU: 0 UID: 0 PID: 63 Comm: kworker/u8:6 Not tainted 6.18.0-rc2-enjuk-tnguy-00378-g3005f5b77652-dirty #156 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: iavf iavf_watchdog_task Call Trace: <TASK> dump_stack_lvl+0x6f/0xb0 print_report+0x170/0x4f3 kasan_report+0xe1/0x1a0 iavf_config_rss+0x619/0x800 iavf_watchdog_task+0x2be7/0x3230 process_one_work+0x7fd/0x1420 worker_thread+0x4d1/0xd40 kthread+0x344/0x660 ret_from_fork+0x249/0x320 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 63: kasan_save_stack+0x30/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 __kmalloc_noprof+0x246/0x6f0 iavf_watchdog_task+0x28fc/0x3230 process_one_work+0x7fd/0x1420 worker_thread+0x4d1/0xd40 kthread+0x344/0x660 ret_from_fork+0x249/0x320 ret_from_fork_asm+0x1a/0x30 The buggy address belongs to the object at ffff888102c50100 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 0 bytes to the right of allocated 52-byte region [ffff888102c50100, ffff888102c50134) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102c50 flags: 0x200000000000000(node=0|zone=2) page_type: f5(slab) raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888102c50000: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc ffff888102c50080: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc >ffff888102c50100: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc ^ ffff888102c50180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc ffff888102c50200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
Severity
No CVSS data available.
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-06-10 20:41 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 43a3d9ba34c9ca313573201d3f45de5ab3494cec , < ceb8459df28d22c225a82d74c0f725f2a935d194 (git)
Affected: 43a3d9ba34c9ca313573201d3f45de5ab3494cec , < 5bb18bfd505ca1affbca921462c350095a6c798c (git)
Affected: 43a3d9ba34c9ca313573201d3f45de5ab3494cec , < d7369dc8dd7cbf5cee3a22610028d847b6f02982 (git)
Affected: 43a3d9ba34c9ca313573201d3f45de5ab3494cec , < 18de0e41d69d97fab10b91fecf10ae78a5e43232 (git)
Affected: 43a3d9ba34c9ca313573201d3f45de5ab3494cec , < f36de3045d006e6d9be1be495f2ed88d1721e752 (git)
Affected: 43a3d9ba34c9ca313573201d3f45de5ab3494cec , < 3095228e1320371e143835d0cebeef1a8a754c66 (git)
Affected: 43a3d9ba34c9ca313573201d3f45de5ab3494cec , < 6daa2893f323981c7894c68440823326e93a7d61 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.7
Unaffected: 0 , < 4.7 (semver)
Unaffected: 5.10.248 , ≤ 5.10.* (semver)
Unaffected: 5.15.198 , ≤ 5.15.* (semver)
Unaffected: 6.1.160 , ≤ 6.1.* (semver)
Unaffected: 6.6.120 , ≤ 6.6.* (semver)
Unaffected: 6.12.64 , ≤ 6.12.* (semver)
Unaffected: 6.18.4 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-71087",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-10T20:41:36.543195Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-11T18:44:14.263Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/iavf/iavf_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ceb8459df28d22c225a82d74c0f725f2a935d194",
              "status": "affected",
              "version": "43a3d9ba34c9ca313573201d3f45de5ab3494cec",
              "versionType": "git"
            },
            {
              "lessThan": "5bb18bfd505ca1affbca921462c350095a6c798c",
              "status": "affected",
              "version": "43a3d9ba34c9ca313573201d3f45de5ab3494cec",
              "versionType": "git"
            },
            {
              "lessThan": "d7369dc8dd7cbf5cee3a22610028d847b6f02982",
              "status": "affected",
              "version": "43a3d9ba34c9ca313573201d3f45de5ab3494cec",
              "versionType": "git"
            },
            {
              "lessThan": "18de0e41d69d97fab10b91fecf10ae78a5e43232",
              "status": "affected",
              "version": "43a3d9ba34c9ca313573201d3f45de5ab3494cec",
              "versionType": "git"
            },
            {
              "lessThan": "f36de3045d006e6d9be1be495f2ed88d1721e752",
              "status": "affected",
              "version": "43a3d9ba34c9ca313573201d3f45de5ab3494cec",
              "versionType": "git"
            },
            {
              "lessThan": "3095228e1320371e143835d0cebeef1a8a754c66",
              "status": "affected",
              "version": "43a3d9ba34c9ca313573201d3f45de5ab3494cec",
              "versionType": "git"
            },
            {
              "lessThan": "6daa2893f323981c7894c68440823326e93a7d61",
              "status": "affected",
              "version": "43a3d9ba34c9ca313573201d3f45de5ab3494cec",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/intel/iavf/iavf_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.120",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.198",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.160",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.120",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.64",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.4",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niavf: fix off-by-one issues in iavf_config_rss_reg()\n\nThere are off-by-one bugs when configuring RSS hash key and lookup\ntable, causing out-of-bounds reads to memory [1] and out-of-bounds\nwrites to device registers.\n\nBefore commit 43a3d9ba34c9 (\"i40evf: Allow PF driver to configure RSS\"),\nthe loop upper bounds were:\n    i \u003c= I40E_VFQF_{HKEY,HLUT}_MAX_INDEX\nwhich is safe since the value is the last valid index.\n\nThat commit changed the bounds to:\n    i \u003c= adapter-\u003erss_{key,lut}_size / 4\nwhere `rss_{key,lut}_size / 4` is the number of dwords, so the last\nvalid index is `(rss_{key,lut}_size / 4) - 1`. Therefore, using `\u003c=`\naccesses one element past the end.\n\nFix the issues by using `\u003c` instead of `\u003c=`, ensuring we do not exceed\nthe bounds.\n\n[1] KASAN splat about rss_key_size off-by-one\n  BUG: KASAN: slab-out-of-bounds in iavf_config_rss+0x619/0x800\n  Read of size 4 at addr ffff888102c50134 by task kworker/u8:6/63\n\n  CPU: 0 UID: 0 PID: 63 Comm: kworker/u8:6 Not tainted 6.18.0-rc2-enjuk-tnguy-00378-g3005f5b77652-dirty #156 PREEMPT(voluntary)\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n  Workqueue: iavf iavf_watchdog_task\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x6f/0xb0\n   print_report+0x170/0x4f3\n   kasan_report+0xe1/0x1a0\n   iavf_config_rss+0x619/0x800\n   iavf_watchdog_task+0x2be7/0x3230\n   process_one_work+0x7fd/0x1420\n   worker_thread+0x4d1/0xd40\n   kthread+0x344/0x660\n   ret_from_fork+0x249/0x320\n   ret_from_fork_asm+0x1a/0x30\n   \u003c/TASK\u003e\n\n  Allocated by task 63:\n   kasan_save_stack+0x30/0x50\n   kasan_save_track+0x14/0x30\n   __kasan_kmalloc+0x7f/0x90\n   __kmalloc_noprof+0x246/0x6f0\n   iavf_watchdog_task+0x28fc/0x3230\n   process_one_work+0x7fd/0x1420\n   worker_thread+0x4d1/0xd40\n   kthread+0x344/0x660\n   ret_from_fork+0x249/0x320\n   ret_from_fork_asm+0x1a/0x30\n\n  The buggy address belongs to the object at ffff888102c50100\n   which belongs to the cache kmalloc-64 of size 64\n  The buggy address is located 0 bytes to the right of\n   allocated 52-byte region [ffff888102c50100, ffff888102c50134)\n\n  The buggy address belongs to the physical page:\n  page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102c50\n  flags: 0x200000000000000(node=0|zone=2)\n  page_type: f5(slab)\n  raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000\n  raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000\n  page dumped because: kasan: bad access detected\n\n  Memory state around the buggy address:\n   ffff888102c50000: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc\n   ffff888102c50080: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc\n  \u003effff888102c50100: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc\n                                       ^\n   ffff888102c50180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc\n   ffff888102c50200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:54:29.688Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ceb8459df28d22c225a82d74c0f725f2a935d194"
        },
        {
          "url": "https://git.kernel.org/stable/c/5bb18bfd505ca1affbca921462c350095a6c798c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d7369dc8dd7cbf5cee3a22610028d847b6f02982"
        },
        {
          "url": "https://git.kernel.org/stable/c/18de0e41d69d97fab10b91fecf10ae78a5e43232"
        },
        {
          "url": "https://git.kernel.org/stable/c/f36de3045d006e6d9be1be495f2ed88d1721e752"
        },
        {
          "url": "https://git.kernel.org/stable/c/3095228e1320371e143835d0cebeef1a8a754c66"
        },
        {
          "url": "https://git.kernel.org/stable/c/6daa2893f323981c7894c68440823326e93a7d61"
        }
      ],
      "title": "iavf: fix off-by-one issues in iavf_config_rss_reg()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71087",
    "datePublished": "2026-01-13T15:34:49.691Z",
    "dateReserved": "2026-01-13T15:30:19.649Z",
    "dateUpdated": "2026-06-11T18:44:14.263Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-71087",
      "date": "2026-09-16",
      "epss": "0.00134",
      "percentile": "0.03254"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-18T14:16:41.000Z",
      "cve": "CVE-2025-71087",
      "id": "msrc_CVE-2025-71087",
      "initial_release_date": "2026-01-02T00:00:00.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "iavf: fix off-by-one issues in iavf_config_rss_reg()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2025-71087.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-71087\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-01-13T16:16:08.343\",\"lastModified\":\"2026-06-17T10:03:38.077\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\niavf: fix off-by-one issues in iavf_config_rss_reg()\\n\\nThere are off-by-one bugs when configuring RSS hash key and lookup\\ntable, causing out-of-bounds reads to memory [1] and out-of-bounds\\nwrites to device registers.\\n\\nBefore commit 43a3d9ba34c9 (\\\"i40evf: Allow PF driver to configure RSS\\\"),\\nthe loop upper bounds were:\\n    i \u003c= I40E_VFQF_{HKEY,HLUT}_MAX_INDEX\\nwhich is safe since the value is the last valid index.\\n\\nThat commit changed the bounds to:\\n    i \u003c= adapter-\u003erss_{key,lut}_size / 4\\nwhere `rss_{key,lut}_size / 4` is the number of dwords, so the last\\nvalid index is `(rss_{key,lut}_size / 4) - 1`. Therefore, using `\u003c=`\\naccesses one element past the end.\\n\\nFix the issues by using `\u003c` instead of `\u003c=`, ensuring we do not exceed\\nthe bounds.\\n\\n[1] KASAN splat about rss_key_size off-by-one\\n  BUG: KASAN: slab-out-of-bounds in iavf_config_rss+0x619/0x800\\n  Read of size 4 at addr ffff888102c50134 by task kworker/u8:6/63\\n\\n  CPU: 0 UID: 0 PID: 63 Comm: kworker/u8:6 Not tainted 6.18.0-rc2-enjuk-tnguy-00378-g3005f5b77652-dirty #156 PREEMPT(voluntary)\\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\n  Workqueue: iavf iavf_watchdog_task\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0x6f/0xb0\\n   print_report+0x170/0x4f3\\n   kasan_report+0xe1/0x1a0\\n   iavf_config_rss+0x619/0x800\\n   iavf_watchdog_task+0x2be7/0x3230\\n   process_one_work+0x7fd/0x1420\\n   worker_thread+0x4d1/0xd40\\n   kthread+0x344/0x660\\n   ret_from_fork+0x249/0x320\\n   ret_from_fork_asm+0x1a/0x30\\n   \u003c/TASK\u003e\\n\\n  Allocated by task 63:\\n   kasan_save_stack+0x30/0x50\\n   kasan_save_track+0x14/0x30\\n   __kasan_kmalloc+0x7f/0x90\\n   __kmalloc_noprof+0x246/0x6f0\\n   iavf_watchdog_task+0x28fc/0x3230\\n   process_one_work+0x7fd/0x1420\\n   worker_thread+0x4d1/0xd40\\n   kthread+0x344/0x660\\n   ret_from_fork+0x249/0x320\\n   ret_from_fork_asm+0x1a/0x30\\n\\n  The buggy address belongs to the object at ffff888102c50100\\n   which belongs to the cache kmalloc-64 of size 64\\n  The buggy address is located 0 bytes to the right of\\n   allocated 52-byte region [ffff888102c50100, ffff888102c50134)\\n\\n  The buggy address belongs to the physical page:\\n  page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102c50\\n  flags: 0x200000000000000(node=0|zone=2)\\n  page_type: f5(slab)\\n  raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000\\n  raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000\\n  page dumped because: kasan: bad access detected\\n\\n  Memory state around the buggy address:\\n   ffff888102c50000: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc\\n   ffff888102c50080: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc\\n  \u003effff888102c50100: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc\\n                                       ^\\n   ffff888102c50180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc\\n   ffff888102c50200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\niavf: corrige problemas de \u0027off-by-one\u0027 en iavf_config_rss_reg()\\n\\nExisten errores de \u0027off-by-one\u0027 al configurar la clave hash RSS y la tabla de b\u00fasqueda, causando lecturas fuera de l\u00edmites a la memoria [1] y escrituras fuera de l\u00edmites a los registros del dispositivo.\\n\\nAntes del commit 43a3d9ba34c9 (\u0027i40evf: Permitir al controlador PF configurar RSS\u0027), los l\u00edmites superiores del bucle eran:\\n    i \u0026lt;= I40E_VFQF_{HKEY,HLUT}_MAX_INDEX\\nlo cual es seguro ya que el valor es el \u00faltimo \u00edndice v\u00e1lido.\\n\\nEse commit cambi\u00f3 los l\u00edmites a:\\n    i \u0026lt;= adapter-\u0026gt;rss_{key,lut}_size / 4\\ndonde \u0027rss_{key,lut}_size / 4\u0027 es el n\u00famero de dwords, por lo que el \u00faltimo \u00edndice v\u00e1lido es \u0027(rss_{key,lut}_size / 4) - 1\u0027. Por lo tanto, usar \u0027\u0026lt;=\u0027 accede a un elemento m\u00e1s all\u00e1 del final.\\n\\nSe corrigen los problemas usando \u0027\u0026lt;\u0027 en lugar de \u0027\u0026lt;=\u0027, asegurando que no excedemos los l\u00edmites.\\n\\n[1] Informe de KASAN sobre el \u0027off-by-one\u0027 de rss_key_size\\n  ERROR: KASAN: \u0027slab-out-of-bounds\u0027 en iavf_config_rss+0x619/0x800\\n  Lectura de tama\u00f1o 4 en la direcci\u00f3n ffff888102c50134 por la tarea kworker/u8:6/63\\n\\n  CPU: 0 UID: 0 PID: 63 Comm: kworker/u8:6 No contaminado 6.18.0-rc2-enjuk-tnguy-00378-g3005f5b77652-dirty #156 PREEMPT(voluntario)\\n  Nombre del hardware: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\n  Cola de trabajo: iavf iavf_watchdog_task\\n  Traza de llamadas:\\n   \\n   dump_stack_lvl+0x6f/0xb0\\n   print_report+0x170/0x4f3\\n   kasan_report+0xe1/0x1a0\\n   iavf_config_rss+0x619/0x800\\n   iavf_watchdog_task+0x2be7/0x3230\\n   process_one_work+0x7fd/0x1420\\n   worker_thread+0x4d1/0xd40\\n   kthread+0x344/0x660\\n   ret_from_fork+0x249/0x320\\n   ret_from_fork_asm+0x1a/0x30\\n   \\n\\n  Asignado por la tarea 63:\\n   kasan_save_stack+0x30/0x50\\n   kasan_save_track+0x14/0x30\\n   __kasan_kmalloc+0x7f/0x90\\n   __kmalloc_noprof+0x246/0x6f0\\n   iavf_watchdog_task+0x28fc/0x3230\\n   process_one_work+0x7fd/0x1420\\n   worker_thread+0x4d1/0xd40\\n   kthread+0x344/0x660\\n   ret_from_fork+0x249/0x320\\n   ret_from_fork_asm+0x1a/0x30\\n\\n  La direcci\u00f3n con error pertenece al objeto en ffff888102c50100\\n   el cual pertenece a la cach\u00e9 kmalloc-64 de tama\u00f1o 64\\n  La direcci\u00f3n con error est\u00e1 ubicada 0 bytes a la derecha de\\n   la regi\u00f3n asignada de 52 bytes [ffff888102c50100, ffff888102c50134)\\n\\n  La direcci\u00f3n con error pertenece a la p\u00e1gina f\u00edsica:\\n  p\u00e1gina: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102c50\\n  flags: 0x200000000000000(node=0|zone=2)\\n  page_type: f5(slab)\\n  raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000\\n  raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000\\n  p\u00e1gina volcada porque: kasan: acceso incorrecto detectado\\n\\n  Estado de la memoria alrededor de la direcci\u00f3n con error:\\n   ffff888102c50000: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc\\n   ffff888102c50080: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc\\n  \u0026gt;ffff888102c50100: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc\\n                                       ^\\n   ffff888102c50180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc\\n   ffff888102c50200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/net/ethernet/intel/iavf/iavf_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"43a3d9ba34c9ca313573201d3f45de5ab3494cec\",\"lessThan\":\"ceb8459df28d22c225a82d74c0f725f2a935d194\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"43a3d9ba34c9ca313573201d3f45de5ab3494cec\",\"lessThan\":\"5bb18bfd505ca1affbca921462c350095a6c798c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"43a3d9ba34c9ca313573201d3f45de5ab3494cec\",\"lessThan\":\"d7369dc8dd7cbf5cee3a22610028d847b6f02982\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"43a3d9ba34c9ca313573201d3f45de5ab3494cec\",\"lessThan\":\"18de0e41d69d97fab10b91fecf10ae78a5e43232\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"43a3d9ba34c9ca313573201d3f45de5ab3494cec\",\"lessThan\":\"f36de3045d006e6d9be1be495f2ed88d1721e752\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"43a3d9ba34c9ca313573201d3f45de5ab3494cec\",\"lessThan\":\"3095228e1320371e143835d0cebeef1a8a754c66\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"43a3d9ba34c9ca313573201d3f45de5ab3494cec\",\"lessThan\":\"6daa2893f323981c7894c68440823326e93a7d61\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/net/ethernet/intel/iavf/iavf_main.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.248\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.198\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.160\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.120\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.64\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.4\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-06-10T20:41:36.543195Z\",\"id\":\"CVE-2025-71087\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-193\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.7.1\",\"versionEndExcluding\":\"5.10.248\",\"matchCriteriaId\":\"6D7D3E72-3D01-4F26-8FA2-72370332ACC4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.198\",\"matchCriteriaId\":\"82159CAA-B6BA-43C6-85D8-65BDBC175A7E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.160\",\"matchCriteriaId\":\"C10CC03E-16A9-428A-B449-40D3763E15F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.120\",\"matchCriteriaId\":\"43C3A206-5EEE-417B-AA0F-EF8972E7A9F0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.64\",\"matchCriteriaId\":\"32BF4A52-377C-44ED-B5E6-7EA5D896E98B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.4\",\"matchCriteriaId\":\"DC988EA0-0E32-457A-BF95-89BEB31A227B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:4.7:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"2F890998-2B89-4DE8-BA87-5B3D9A5E8E11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F71D92C0-C023-48BD-B3B6-70B638EEE298\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"13580667-0A98-40CC-B29F-D12790B91BDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EF854A1-ABB1-4E93-BE9A-44569EC76C0D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB5B7DFC-C36B-45D8-922C-877569FDDF43\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/18de0e41d69d97fab10b91fecf10ae78a5e43232\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3095228e1320371e143835d0cebeef1a8a754c66\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5bb18bfd505ca1affbca921462c350095a6c798c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6daa2893f323981c7894c68440823326e93a7d61\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ceb8459df28d22c225a82d74c0f725f2a935d194\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d7369dc8dd7cbf5cee3a22610028d847b6f02982\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f36de3045d006e6d9be1be495f2ed88d1721e752\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T07:12:21+00:00",
      "cve": "CVE-2025-71087",
      "id": "CVE-2025-71087",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: iavf: fix off-by-one issues in iavf_config_rss_reg()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-71087.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T01:11:24Z",
      "cve": "CVE-2025-71087",
      "id": "CVE-2025-71087",
      "initial_release_date": "2026-01-14T00:25:37Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "676",
      "product_status:known_not_affected": "32",
      "product_status:recommended": "326",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-71087",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-71087.json",
      "version": "33"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-71087\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-10T20:41:36.543195Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-11T17:38:32.494Z\"}}], \"cna\": {\"title\": \"iavf: fix off-by-one issues in iavf_config_rss_reg()\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"43a3d9ba34c9ca313573201d3f45de5ab3494cec\", \"lessThan\": \"ceb8459df28d22c225a82d74c0f725f2a935d194\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"43a3d9ba34c9ca313573201d3f45de5ab3494cec\", \"lessThan\": \"5bb18bfd505ca1affbca921462c350095a6c798c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"43a3d9ba34c9ca313573201d3f45de5ab3494cec\", \"lessThan\": \"d7369dc8dd7cbf5cee3a22610028d847b6f02982\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"43a3d9ba34c9ca313573201d3f45de5ab3494cec\", \"lessThan\": \"18de0e41d69d97fab10b91fecf10ae78a5e43232\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"43a3d9ba34c9ca313573201d3f45de5ab3494cec\", \"lessThan\": \"f36de3045d006e6d9be1be495f2ed88d1721e752\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"43a3d9ba34c9ca313573201d3f45de5ab3494cec\", \"lessThan\": \"3095228e1320371e143835d0cebeef1a8a754c66\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"43a3d9ba34c9ca313573201d3f45de5ab3494cec\", \"lessThan\": \"6daa2893f323981c7894c68440823326e93a7d61\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/net/ethernet/intel/iavf/iavf_main.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"4.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.248\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.198\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.160\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.120\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.64\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"6.19\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/net/ethernet/intel/iavf/iavf_main.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ceb8459df28d22c225a82d74c0f725f2a935d194\"}, {\"url\": \"https://git.kernel.org/stable/c/5bb18bfd505ca1affbca921462c350095a6c798c\"}, {\"url\": \"https://git.kernel.org/stable/c/d7369dc8dd7cbf5cee3a22610028d847b6f02982\"}, {\"url\": \"https://git.kernel.org/stable/c/18de0e41d69d97fab10b91fecf10ae78a5e43232\"}, {\"url\": \"https://git.kernel.org/stable/c/f36de3045d006e6d9be1be495f2ed88d1721e752\"}, {\"url\": \"https://git.kernel.org/stable/c/3095228e1320371e143835d0cebeef1a8a754c66\"}, {\"url\": \"https://git.kernel.org/stable/c/6daa2893f323981c7894c68440823326e93a7d61\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\niavf: fix off-by-one issues in iavf_config_rss_reg()\\n\\nThere are off-by-one bugs when configuring RSS hash key and lookup\\ntable, causing out-of-bounds reads to memory [1] and out-of-bounds\\nwrites to device registers.\\n\\nBefore commit 43a3d9ba34c9 (\\\"i40evf: Allow PF driver to configure RSS\\\"),\\nthe loop upper bounds were:\\n    i \u003c= I40E_VFQF_{HKEY,HLUT}_MAX_INDEX\\nwhich is safe since the value is the last valid index.\\n\\nThat commit changed the bounds to:\\n    i \u003c= adapter-\u003erss_{key,lut}_size / 4\\nwhere `rss_{key,lut}_size / 4` is the number of dwords, so the last\\nvalid index is `(rss_{key,lut}_size / 4) - 1`. Therefore, using `\u003c=`\\naccesses one element past the end.\\n\\nFix the issues by using `\u003c` instead of `\u003c=`, ensuring we do not exceed\\nthe bounds.\\n\\n[1] KASAN splat about rss_key_size off-by-one\\n  BUG: KASAN: slab-out-of-bounds in iavf_config_rss+0x619/0x800\\n  Read of size 4 at addr ffff888102c50134 by task kworker/u8:6/63\\n\\n  CPU: 0 UID: 0 PID: 63 Comm: kworker/u8:6 Not tainted 6.18.0-rc2-enjuk-tnguy-00378-g3005f5b77652-dirty #156 PREEMPT(voluntary)\\n  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\n  Workqueue: iavf iavf_watchdog_task\\n  Call Trace:\\n   \u003cTASK\u003e\\n   dump_stack_lvl+0x6f/0xb0\\n   print_report+0x170/0x4f3\\n   kasan_report+0xe1/0x1a0\\n   iavf_config_rss+0x619/0x800\\n   iavf_watchdog_task+0x2be7/0x3230\\n   process_one_work+0x7fd/0x1420\\n   worker_thread+0x4d1/0xd40\\n   kthread+0x344/0x660\\n   ret_from_fork+0x249/0x320\\n   ret_from_fork_asm+0x1a/0x30\\n   \u003c/TASK\u003e\\n\\n  Allocated by task 63:\\n   kasan_save_stack+0x30/0x50\\n   kasan_save_track+0x14/0x30\\n   __kasan_kmalloc+0x7f/0x90\\n   __kmalloc_noprof+0x246/0x6f0\\n   iavf_watchdog_task+0x28fc/0x3230\\n   process_one_work+0x7fd/0x1420\\n   worker_thread+0x4d1/0xd40\\n   kthread+0x344/0x660\\n   ret_from_fork+0x249/0x320\\n   ret_from_fork_asm+0x1a/0x30\\n\\n  The buggy address belongs to the object at ffff888102c50100\\n   which belongs to the cache kmalloc-64 of size 64\\n  The buggy address is located 0 bytes to the right of\\n   allocated 52-byte region [ffff888102c50100, ffff888102c50134)\\n\\n  The buggy address belongs to the physical page:\\n  page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x102c50\\n  flags: 0x200000000000000(node=0|zone=2)\\n  page_type: f5(slab)\\n  raw: 0200000000000000 ffff8881000418c0 dead000000000122 0000000000000000\\n  raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000\\n  page dumped because: kasan: bad access detected\\n\\n  Memory state around the buggy address:\\n   ffff888102c50000: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc\\n   ffff888102c50080: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc\\n  \u003effff888102c50100: 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc fc\\n                                       ^\\n   ffff888102c50180: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc\\n   ffff888102c50200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.248\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.198\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.160\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.120\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.64\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.4\", \"versionStartIncluding\": \"4.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.19\", \"versionStartIncluding\": \"4.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T21:54:29.688Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-71087\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-11T18:44:14.263Z\", \"dateReserved\": \"2026-01-13T15:30:19.649Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-01-13T15:34:49.691Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.