CVE-2025-71122: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71122 is an integer overflow vulnerability in the Linux kernel's iommufd selftest component, specifically in the IOMMU_TEST_OP_ADD_RESERVED ioctl handler. Discovered by syzkaller fuzzing and published on January 14, 2026, the flaw allows a local attacker with low privileges to corrupt the reserved interval tree, potentially causing system instability, denial of service, or privilege escalation. It exclusively affects kernels built with CONFIG_IOMMUFD_TEST enabled, limiting its real-world exposure to test and development environments. Affected kernel versions include 6.2.1–6.6.119, 6.7–6.12.63, 6.13–6.18.2, and 6.19 release candidates. The CVSS v3.1 base score is 7.8 (High) (Feedly, kernel.org patches).

The root cause is an integer overflow (CWE-190 / arithmetic overflow) in the IOMMU_TEST_OP_ADD_RESERVED ioctl handler within the iommufd selftest infrastructure. The handler fails to validate the user-supplied length parameter before performing arithmetic, allowing an attacker to craft an ioctl call with a value that overflows, corrupting the kernel's reserved interval tree data structure and triggering a WARN_ON. The attack vector is local (AV:L), requires only low privileges (PR:L), no user interaction, and has low complexity, making it straightforward to trigger on any test kernel with CONFIG_IOMMUFD_TEST compiled in. The fix adds explicit bounds checking on the user input length before the arithmetic operation (Feedly, kernel.org patches).

Successful exploitation can result in kernel data structure corruption (the reserved interval tree), leading to system instability, denial of service via kernel WARN_ON or crash, or potential privilege escalation from a low-privileged local user to higher access levels. Confidentiality, integrity, and availability are all rated High in the CVSS assessment. The impact is constrained to systems running test kernels with CONFIG_IOMMUFD_TEST enabled, which are typically development, CI, or fuzzing environments rather than production deployments (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability was discovered through syzkaller, Google's kernel fuzzing framework, indicating it was found via automated fuzzing rather than targeted research. The EPSS score is approximately 0.018% (0.000180), reflecting very low probability of exploitation in the near term. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further limited by the requirement for CONFIG_IOMMUFD_TEST to be enabled, which is not a standard production kernel configuration (Feedly).

Patches are available in Linux kernel stable branches: versions 6.6.120+, 6.12.64+, and 6.18.3+ contain the fix. Four patch commits are available at git.kernel.org addressing the affected stable branches. As an immediate workaround, disable CONFIG_IOMMUFD_TEST in any kernel build configuration, as this option should never be enabled in production environments. Organizations should audit their kernel build configurations to ensure test options are not present in production or staging systems, and apply the relevant stable kernel update (Feedly, kernel.org patches).