CVE-2025-71101: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71101 is an out-of-bounds read vulnerability in the Linux kernel's hp-bioscfg platform driver, affecting ACPI package parsing logic. It was published on January 13, 2026, and affects Linux kernel versions 6.6 (base), 6.6.1–6.6.119, 6.7–6.12.63, 6.13–6.18.3, and 6.19-rc1 through 6.19-rc8. The vulnerability carries a CVSS v3.1 base score of 7.1 (High) (Red Hat CVE, Feedly).

The root cause is an improper bounds check (CWE-125: Out-of-bounds Read) in the hp_populate_*_elements_from_package() functions within the hp-bioscfg kernel driver. These functions iterate through ACPI package arrays (e.g., enum_obj, integer_obj, order_obj, password_obj, string_obj) using a loop index elem, but when processing multi-element fields such as PREREQUISITES and ENUM_POSSIBLE_VALUES, they access memory at offsets like enum_obj[elem + reqs] and enum_obj[elem + pos_values]. The bounds check only validated the base index elem without accounting for the additional offset, allowing reads beyond the allocated array boundary. Exploitation requires local access with low privileges, as the vulnerable code path is triggered during ACPI package parsing in the HP BIOS configuration driver (Feedly).

A local attacker with low privileges can trigger the out-of-bounds read to access sensitive kernel memory contents, resulting in high confidentiality impact. The flaw can also cause denial-of-service conditions by destabilizing kernel memory state, resulting in high availability impact. Integrity is not directly affected. The vulnerability is scoped to the local system and does not provide a direct path for remote exploitation or lateral movement, but kernel memory disclosure could expose credentials or cryptographic material (Feedly).

Patches are available in the Linux kernel stable repositories. Administrators should update to the following fixed versions: 6.6.120 or later, 6.12.64 or later, 6.18.4 or later, or 6.19-rc4 or later (Feedly, kernel.org patch). For systems that cannot be immediately patched, restrict local user access to minimize exposure and consider disabling HP BIOS configuration features via the hp-bioscfg driver if not operationally required. Ubuntu security notices USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, and USN-8257-1 address this vulnerability for affected Ubuntu releases (Ubuntu USN-8177-1, Ubuntu USN-8183-1).

Red Hat has published a CVE advisory tracking this issue, and Ubuntu has issued multiple security notices (USN-8177-1/2, USN-8183-1/2, USN-8245-1, USN-8257-1) addressing the vulnerability across affected kernel packages (Red Hat CVE, Ubuntu USN-8177-1). The Yocto Project security mailing list has also discussed the issue in the context of embedded Linux distributions. No notable independent researcher commentary or significant social media discussion has been observed.