CVE-2025-71136: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71136 is an out-of-bounds read vulnerability in the Linux kernel's media: adv7842 driver, specifically within the adv7842_cp_log_status() function. The cp_read() and hdmi_read() functions can return -EIO (a negative error value), which is then used directly as an array index without validation, leading to potential out-of-bounds memory access. The vulnerability was discovered by the Linux Verification Center (linuxtesting.org) using the SVACE static analysis tool and was published on January 14, 2026. Affected versions span Linux kernel 3.12 through multiple 6.x branches up to 6.18.x. It carries a CVSS v3.1 base score of 7.1 (High) (Feedly, NVD).

The root cause is classified as CWE-125 (Out-of-bounds Read). In the adv7842_cp_log_status() function of the adv7842 media driver, return values from cp_read() and hdmi_read() — which can be -EIO (typically -5) on I2C communication failure — are used directly as array indexes without any error checking. A negative index value used to access a fixed-size array results in a read from memory outside the intended buffer boundaries. Exploitation requires local access to a system with the adv7842 driver loaded (typically systems with Analog Devices ADV7842 video decoder hardware), and low-privilege user access is sufficient (NVD, Feedly).

Successful exploitation by a local low-privilege attacker could result in reading sensitive kernel memory (high confidentiality impact) or triggering kernel crashes leading to denial of service (high availability impact). There is no integrity impact assessed. The vulnerability is scoped to the affected system and does not directly enable lateral movement, but kernel memory disclosure could potentially expose credentials or cryptographic material useful for further attacks (Feedly, NVD).

Update the Linux kernel to a patched version as the primary remediation. Fixed versions include: 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, and 6.18.4 or later. As a secondary measure, restrict local user access to affected systems and apply the principle of least privilege. If the adv7842 driver is not required, it can be blacklisted to reduce attack surface. Patches have been committed to the stable kernel trees and are available via kernel.org (Feedly, NVD).