CVE-2025-71064: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71064 is a memory initialization vulnerability in the Linux kernel's HNS3 (Huawei Network Subsystem 3) virtual function (VF) driver. The flaw was published on January 13, 2026, and affects Linux kernel versions from 4.16 up to (but not including) the patched releases. Specifically, hdev->htqp is allocated using hdev->num_tqps, while kinfo->tqp is allocated using kinfo->num_tqps (set to min(new_tqps, hdev->num_tqps)), causing some hdev->htqp[i] array elements to remain uninitialized in hclgevf_knic_setup(). No CVSS score has been assigned by NVD at this time; the EPSS score is approximately 0.018% (Feedly, kernel.org patch).

The root cause is improper memory initialization (related to CWE-665: Improper Initialization) in the hclgevf_knic_setup() function of the HNS3 VF driver. Because kinfo->num_tqps is capped at min(new_tqps, hdev->num_tqps), it can be smaller than hdev->num_tqps, leaving upper-indexed elements of the hdev->htqp array uninitialized when both arrays are allocated with different sizes. The fix aligns both hdev->htqp and kinfo->tqp allocations to use hdev->num_tqps, ensuring consistent array lengths and full initialization. Exploitation would require local access to a system using Huawei HNS3 network hardware in a VF configuration (Feedly, kernel.org patch).

Successful exploitation could lead to kernel information disclosure, memory corruption, or denial of service on systems using HNS3 VF drivers. The impact is confined to systems with Huawei HNS3 network hardware operating in virtual function configurations, limiting the affected population. There is no evidence of lateral movement potential beyond the local kernel context (Feedly).

Patches are available in the following Linux kernel stable releases: 6.1.160, 6.6.120, 6.12.64, 6.18.3, and 6.19-rc2. Corresponding upstream commits include 1956d47a, 429f946a, 62f28d79, 6cd8a293, and c2a16269. Debian and Ubuntu have also issued security advisories (DSA-6126-1, DLA-4475-1, USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, USN-8257-1) addressing this CVE. For systems that cannot be patched immediately, restricting local user access and disabling HNS3 VF functionality if not required are recommended interim mitigations (Feedly, Ubuntu USN-8177-1, Debian LTS).