CVE-2025-71121: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-71121 is a Linux kernel vulnerability in the PA-RISC architecture code where attempting to reprogram CPU affinity on the legacy ASP chip (found in HP 730 workstations) causes the kernel to crash with an HPMC (Hypervisor Memory Check) exception. The issue was published on January 14, 2026, and affects multiple Linux kernel stable branches across a wide version range. Affected versions include kernels from 4.14.276 through various stable series up to 6.18.x (before 6.18.3), 6.12.x (before 6.12.64), 6.6.x (before 6.6.120), 6.1.x (before 6.1.160), 5.15.x (before 5.15.198), 5.10.x (before 5.10.248), and others. It carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly, kernel.org patches).

The root cause is improper hardware register access in the Linux kernel's PA-RISC interrupt controller driver: when the kernel attempts to reprogram CPU affinity on the ASP chip, it accesses registers at memory locations that do not exist on that chip variant, triggering a fatal HPMC exception. The ASP chip is an older variant of the GSP chip and lacks the affinity-related registers at the expected offsets; since HP 730 workstations are single-CPU machines, affinity reprogramming is also functionally unnecessary. The fix adds a check of the chip's sversion field to skip affinity reprogramming on ASP hardware. NVD classifies this as CWE-noinfo (Insufficient Information), and the vulnerability requires local access with low privileges to trigger (e.g., by initiating operations that invoke CPU affinity code paths on affected hardware) (Feedly, kernel.org patches).

Exploitation results exclusively in a denial of service: the affected PA-RISC ASP-based system halts unexpectedly with an HPMC exception, causing complete loss of availability. There is no confidentiality or integrity impact. The scope is limited to legacy PA-RISC hardware (specifically HP 730 workstations running affected kernel versions), and lateral movement or data exfiltration are not applicable given the nature of the crash (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The EPSS score is approximately 0.018% (0.000180), indicating very low likelihood of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained to local access on rare, legacy PA-RISC ASP hardware, significantly limiting the practical attack surface (Feedly).

Apply the available kernel patches for the relevant stable branch. Fixed versions include: 4.15+, 4.20+, 5.5+, 5.10.248+, 5.15.198+, 5.17+, 5.18+, 6.1.160+, 6.6.120+, 6.12.64+, and 6.18.3+. Patches are available from kernel.org stable branches. As a workaround on systems that cannot be patched immediately, restricting local user execution privileges on PA-RISC ASP-based systems can reduce exposure, though upgrading to a patched kernel version is the recommended remediation (Feedly, kernel.org patches).