CVE-2025-71122: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71122 is an integer overflow vulnerability in the Linux kernel's iommufd selftest component, specifically in the IOMMU_TEST_OP_ADD_RESERVED ioctl handler. Discovered by syzkaller fuzzing and published on January 14, 2026, the flaw allows a local attacker with low privileges to corrupt the reserved interval tree, potentially causing system instability, denial of service, or privilege escalation. It exclusively affects kernels built with CONFIG_IOMMUFD_TEST enabled, limiting its real-world exposure to test and development environments. Affected kernel versions include 6.2.1–6.6.119, 6.7–6.12.63, 6.13–6.18.2, and 6.19 release candidates. The CVSS v3.1 base score is 7.8 (High) (Feedly, kernel.org patches).

The root cause is an integer overflow (CWE-190 / arithmetic overflow) in the IOMMU_TEST_OP_ADD_RESERVED ioctl handler within the iommufd selftest infrastructure. The handler fails to validate the user-supplied length parameter before performing arithmetic, allowing an attacker to craft an ioctl call with a value that overflows, corrupting the kernel's reserved interval tree data structure and triggering a WARN_ON. The attack vector is local (AV:L), requires only low privileges (PR:L), no user interaction, and has low complexity, making it straightforward to trigger on any test kernel with CONFIG_IOMMUFD_TEST compiled in. The fix adds explicit bounds checking on the user input length before the arithmetic operation (Feedly, kernel.org patches).

Successful exploitation can result in kernel data structure corruption (the reserved interval tree), leading to system instability, denial of service via kernel WARN_ON or crash, or potential privilege escalation from a low-privileged local user to higher access levels. Confidentiality, integrity, and availability are all rated High in the CVSS assessment. The impact is constrained to systems running test kernels with CONFIG_IOMMUFD_TEST enabled, which are typically development, CI, or fuzzing environments rather than production deployments (Feedly).

Patches are available in Linux kernel stable branches: versions 6.6.120+, 6.12.64+, and 6.18.3+ contain the fix. Four patch commits are available at git.kernel.org addressing the affected stable branches. As an immediate workaround, disable CONFIG_IOMMUFD_TEST in any kernel build configuration, as this option should never be enabled in production environments. Organizations should audit their kernel build configurations to ensure test options are not present in production or staging systems, and apply the relevant stable kernel update (Feedly, kernel.org patches).