CVE-2025-71087 Linux CVE debrief

Who should care

Linux kernel maintainers, administrators, and users of affected versions should be aware of this vulnerability and apply patches to prevent out-of-bounds reads and writes. They should also monitor for potential security issues related to iavf driver configuration and update Linux kernel versions to ensure fixes are applied.

Why it matters

The Linux kernel iavf driver vulnerability requires patch application to prevent out-of-bounds reads and writes, impacting Linux kernel maintainers, administrators, and users of affected versions.

• Verify Linux kernel versions and apply patches to prevent out-of-bounds reads and writes
• Monitor for potential security issues related to iavf driver configuration
• Update Linux kernel to ensure fixes are applied and prevent potential security risks

Technical summary

The iavf driver in the Linux kernel had off-by-one bugs when configuring RSS hash key and lookup table, causing out-of-bounds reads and writes. Multiple patches were applied to fix these issues by changing loop bounds from <= to <, ensuring that the bounds are not exceeded. The fix prevents potential security risks related to iavf driver configuration. The vulnerability was discovered through a KASAN splat, indicating a slab-out-of-bounds read of size 4 at addr ffff888102c50134. The issue requires patch application to prevent out-of-bounds reads and writes.

Defensive priority

Apply patches to address off-by-one errors in iavf driver

Recommended defensive actions

• Apply patches to address off-by-one errors in iavf driver
• Review and update Linux kernel versions to ensure fixes are applied
• Monitor for potential out-of-bounds reads and writes
• Verify Linux kernel versions and apply patches to prevent out-of-bounds reads and writes
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including a KASAN splat about rss_key_size off-by-one. Multiple patches are referenced to address this issue, including fixes for off-by-one bugs in iavf_config_rss_reg(). The patches ensure that the loop upper bounds are correctly configured to prevent out-of-bounds reads and writes. Evidence limits are based on source-provided details and defensive verification tasks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.