CVE-2025-71112: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71112 is an out-of-bounds read vulnerability in the Linux kernel's HNS3 (HiSilicon Network Subsystem 3) network driver affecting VLAN configuration handling. The flaw was published on January 14, 2026, and stems from the driver's failure to validate VLAN IDs received via mailbox messages from Virtual Functions (VFs) before using them to index the vlan_del_fail_bmap bitmap array. Affected kernel versions include 5.3 through 5.10.247, 5.11 through 5.15.197, 5.16 through 6.1.159, 6.2 through 6.6.119, 6.7 through 6.12.63, 6.13 through 6.18.2, and release candidates of 6.19. It carries a CVSS v3.1 base score of 7.1 (High) (Feedly, kernel.org patches).

The root cause is classified as CWE-125 (Out-of-bounds Read). When the HNS3 Physical Function (PF) driver receives a VLAN configuration mailbox message from a VF, it uses the supplied VLAN ID directly to access the vlan_del_fail_bmap array, which is allocated with a fixed size of BITS_TO_LONGS(VLAN_N_VID) (i.e., sized for VLAN IDs 0–4095). If a VF sends a VLAN ID ≥ 4096 (VLAN_N_VID), the driver reads memory beyond the array's bounds. The attack vector is local, requires low privileges (a VF context in a virtualized environment), and no user interaction, making it exploitable by a guest VM or container with access to a VF (Feedly).

Successful exploitation can result in high confidentiality impact through unauthorized reads of kernel memory adjacent to the vlan_del_fail_bmap array, potentially exposing sensitive data such as kernel pointers or other driver state. It can also cause a denial of service (high availability impact) by triggering a kernel crash or memory corruption. In virtualized environments, a malicious guest with VF access could affect the host kernel or co-resident VMs, representing a meaningful cross-VM risk (Feedly).

Patches are available across multiple stable kernel branches. Administrators should upgrade to one of the following fixed versions: 5.10.248+, 5.15.198+, 6.1.160+, 6.6.120+, 6.12.64+, or 6.18.3+, depending on the deployed branch (kernel.org patches). Debian has also released updated packages (e.g., linux 6.1.162-1 for oldstable and linux 5.10.249-1 for oldoldstable) (Debian LTS). As a workaround for systems that cannot be immediately patched, restrict VF assignment to trusted guests only and disable the HNS3 driver if it is not required in the environment.