CVE-2025-71093: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71093 is an out-of-bounds read vulnerability in the Linux kernel's e1000 network driver, specifically in the e1000_tbi_should_accept() function. The flaw occurs when processing received (RX) frames with a descriptor-reported length of zero or exceeding the actual RX buffer size, causing an out-of-bounds memory read when accessing the last byte of a frame for TBI (Ten Bit Interface) workaround evaluation. Affected kernel versions span from 3.18.1 through multiple stable branches, including versions before 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, and 6.18.4, as well as 6.19 release candidates (Feedly). The vulnerability was published on January 13, 2026, and carries a CVSS v3.1 base score of 7.1 (High) (Feedly).

The root cause is classified as CWE-125 (Out-of-bounds Read). In e1000_tbi_should_accept(), the code reads data[length - 1] to evaluate the TBI workaround without first validating that length is non-zero or within the bounds of the actual RX buffer (adapter->rx_buffer_len). This flaw is triggered from the NAPI receive path (e1000_clean_rx_irq → e1000_clean → __napi_poll → net_rx_action), meaning it can be reached during normal network packet reception. A KASAN report confirms the slab-out-of-bounds read at the kernel level, with the read occurring on unrelated slab objects adjacent to the RX buffer (Feedly). The fix validates the frame length before dereferencing memory, rejecting frames early if the length is zero or exceeds adapter->rx_buffer_len (git.kernel.org).

Successful exploitation allows a local attacker with low privileges to read sensitive data from unrelated kernel slab objects, resulting in information disclosure of kernel memory contents. Additionally, the vulnerability can cause denial of service by triggering kernel instability or crashes through memory corruption detection mechanisms such as KASAN. The confidentiality and availability impacts are both rated High, while integrity is not directly affected (Feedly).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing KASAN reports referencing e1000_tbi_should_accept with messages such as BUG: KASAN: slab-out-of-bounds in e1000_tbi_should_accept+0x610/0x790 and Read of size 1 at addr pointing to kernel slab memory.
• Process: Unusual kernel stack traces involving e1000_clean_rx_irq, e1000_clean, __napi_poll, and net_rx_action in crash dumps or kernel oops reports.
• Network: Anomalous or malformed Ethernet frames received on interfaces using the e1000 driver, particularly frames with zero-length or oversized descriptors.

Apply the available kernel patches for the affected stable branches: upgrade to Linux kernel 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, or 6.18.4 (or later) as appropriate for your distribution (git.kernel.org). Debian, Ubuntu (USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, USN-8257-1), Amazon Linux 2, and Oracle Linux have all issued updated kernel packages (Feedly). As a workaround where patching is not immediately possible, consider disabling the e1000 driver (modprobe -r e1000) if an alternative NIC driver is available, or restrict local system access to trusted users only and isolate systems using e1000 adapters to trusted network segments.