CVE-2025-71108: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71108 is a denial-of-service vulnerability in the Linux kernel's USB Type-C Connector System Software Interface (UCSI) driver, caused by improper handling of a non-compliant num_connectors capability field in firmware. The UCSI specification defines num_connectors as a 7-bit field with the 8th bit reserved and expected to be zero; certain buggy firmware sets this reserved bit, which can prevent the system from booting. The vulnerability was discovered on a Lenovo P1 G8 system during the Linux enablement program and disclosed on January 14, 2026. It affects Linux kernel versions from 4.13.1 through multiple stable branches up to 6.19-rc8, depending on the branch. The CVSS v3.1 base score is 5.5 (Medium) (Feedly, kernel.org patches).

The root cause is insufficient input validation in the UCSI driver when reading the num_connectors capability field from firmware (classified as NVD-CWE-noinfo due to insufficient public detail). The UCSI spec reserves the 8th bit of this 7-bit field; when buggy firmware sets this bit, the kernel driver misinterprets the connector count, leading to a boot failure. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction, meaning the condition is triggered automatically at boot on affected hardware with non-compliant firmware. The fix flags the non-compliant firmware behavior and auto-corrects the num_connectors value to allow the system to boot normally (Feedly, kernel.org patches).

The primary impact is a complete denial of service through system boot failure on affected platforms running vulnerable Linux kernel versions with non-compliant UCSI firmware. There is no confidentiality or integrity impact; the vulnerability is limited to availability (AV:H in CVSS terms). Affected systems become unable to boot until either the kernel is patched or the firmware is updated, effectively rendering the machine inoperable (Feedly).

There is no known public proof-of-concept exploit, no evidence of in-the-wild exploitation, and no threat actor attribution associated with this vulnerability. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), reflecting very low likelihood of exploitation. The vulnerability is hardware-dependent, requiring a system with non-compliant UCSI firmware to trigger, which significantly limits its exploitability surface (Feedly).

Patches are available across multiple stable Linux kernel branches: upgrade to version 5.10.248 or later, 5.15.198 or later, 6.1.160 or later, 6.6.120 or later, 6.12.64 or later, or 6.18.3 or later. The kernel fix automatically detects and corrects the malformed num_connectors value, logging a warning about non-compliant firmware. Additionally, affected device manufacturers (e.g., Lenovo for the P1 G8) are expected to release firmware updates that correct the reserved bit. Debian (DLA-4475-1, linux 5.10.249), Ubuntu (USN-8177-1, USN-8183-1, USN-8245-1, USN-8257-1), SUSE (SUSE-SU-2026:2068-1), and Oracle Linux have all issued advisories with patched kernel packages (Feedly, Debian LTS, Ubuntu USN-8177-1).

The vulnerability received routine coverage from Linux distribution security teams, with Debian, Ubuntu, SUSE, and Oracle Linux all issuing security advisories. No notable researcher commentary or significant social media discussion has been observed beyond standard vulnerability tracking. The fix was noted as a proactive measure to support hardware platforms not officially Linux-supported, reflecting good upstream kernel hygiene (Feedly).