CVE-2025-71076: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71076 is an input validation flaw in the Linux kernel's DRM/XE Open Attributes (OA) subsystem that allows a local low-privileged user to trigger excessive memory allocations by passing arbitrarily large values for the num_syncs parameter. The vulnerability was published on January 13, 2026, and affects Linux kernel versions 6.12.17 through 6.12.64 (exclusive), 6.13 through 6.18.3 (exclusive), and 6.19-rc1 through 6.19-rc8. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, NVD).

The root cause is missing bounds validation on the num_syncs parameter in the OA open path of the drm/xe kernel driver (classified as NVD-CWE-noinfo due to insufficient public detail, but functionally an improper input validation issue). A local attacker with low privileges can invoke the relevant ioctl with an arbitrarily large num_syncs value, causing the kernel to attempt an oversized memory allocation. The fix adds a check ensuring num_syncs does not exceed DRM_XE_MAX_SYNCS, returning -EINVAL when the limit is violated, and uses XE_IOCTL_DBG() for diagnostic output (Feedly, NVD).

Successful exploitation results in a denial-of-service condition through memory exhaustion or kernel crash, impacting system availability. There is no confidentiality or integrity impact — the vulnerability is limited to availability (CVSS A:H, C:N, I:N). The attack is confined to the local system and requires only low-privilege access, with no user interaction needed, making it accessible to any unprivileged local user on an affected system with the DRM/XE graphics driver loaded (Feedly).

Update the Linux kernel to a patched version: 6.12.64 or later for the 6.12.x branch, 6.18.3 or later for the 6.13–6.18 branches, or 6.19-rc2 or later for development builds. Patches are available at the upstream kernel stable tree. As a secondary measure, restrict local user access to systems running the DRM/XE driver to reduce exposure. Downstream distributions including Ubuntu have issued security notices (USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, USN-8257-1) incorporating these fixes (Feedly, Ubuntu USN-8177-1).