CVE-2025-71087: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71087 is an off-by-one error (CWE-193) in the Linux kernel's iavf (Intel Adaptive Virtual Function) driver, specifically within the iavf_config_rss_reg() function responsible for configuring RSS (Receive-Side Scaling) hash key and lookup table registers. The flaw causes loop bounds to use <= instead of <, resulting in out-of-bounds reads from kernel memory and out-of-bounds writes to device registers. It was published on January 13, 2026, and affects Linux kernel versions from 4.7 through multiple stable branches, with fixed versions released across all major stable trees (Feedly, Microsoft MSRC). The CVSS v3.1 base score is 5.5 (Medium), requiring local access with low privileges (Feedly).

The root cause is an off-by-one error (CWE-193) introduced by commit 43a3d9ba34c9 ("i40evf: Allow PF driver to configure RSS"), which changed loop upper bounds from i <= I40E_VFQF_{HKEY,HLUT}_MAX_INDEX (safe, last valid index) to i <= adapter->rss_{key,lut}_size / 4 (incorrect, since size / 4 equals the count of dwords, making the last valid index (size / 4) - 1). The fix replaces <= with < in both loops. The bug is triggered during normal driver operation via the iavf_watchdog_task worker thread, and KASAN confirms a slab-out-of-bounds read of 4 bytes at an address one element past the allocated rss_key buffer (BUG: KASAN: slab-out-of-bounds in iavf_config_rss+0x619/0x800) (Feedly). No special user interaction is required beyond having low-privilege local access on a system using an Intel iavf network device.

Exploitation of this vulnerability can result in kernel memory information disclosure (out-of-bounds read of sensitive kernel heap contents) and denial of service through out-of-bounds writes to device registers, potentially destabilizing the network interface or the kernel itself. The vulnerability is scoped to the local system and does not directly enable remote code execution or lateral movement, but kernel memory disclosure could assist in bypassing KASLR or other mitigations in a chained attack scenario (Feedly).

• Logs: KASAN splat messages in kernel logs such as BUG: KASAN: slab-out-of-bounds in iavf_config_rss+0x619/0x800 with Read of size 4 at an address past the allocated buffer; stack traces referencing iavf_watchdog_task and iavf_config_rss.
• Process: Unexpected kernel worker thread crashes or hangs associated with kworker/u*:*/iavf processes.
• Network: Sudden instability or errors on Intel iavf (virtual function) network interfaces, including unexpected interface resets or register access errors reported in dmesg.

Apply the available kernel patches for the relevant stable branch. Fixed versions are: 5.10.248 or later (5.10 branch), 5.15.198 or later (5.15 branch), 6.1.160 or later (6.1 branch), 6.6.120 or later (6.6 branch), 6.12.64 or later (6.12 branch), and 6.18.4 or later (6.13+ branches) (Feedly, Microsoft MSRC). Patches are available via kernel.org stable trees and have been incorporated into Debian, Ubuntu (USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, USN-8257-1), Amazon Linux 2, and Oracle Linux updates. For systems where immediate patching is not feasible, limiting local user access and monitoring kernel logs for KASAN warnings related to the iavf driver is recommended as a temporary measure.