CVE-2025-71143: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71143 is an improper array index validation vulnerability in the Linux kernel's Samsung Exynos clock output driver (clk-exynos-clkout.c). The flaw arises because the .num member of struct clk_hw_onecell_data is assigned after the .hws[] array is first accessed in exynos_clkout_probe(), triggering UBSAN out-of-bounds warnings at boot time on Exynos-based systems. Affected Linux kernel versions include 6.6.1–6.6.119, 6.7–6.12.63, and 6.13–6.18.3, as well as 6.19 release candidates. It was published on January 14, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (Feedly, MSRC).

The root cause is classified as CWE-129 (Improper Validation of Array Index). Commit f316cdff8d67 annotated the hws member of struct clk_hw_onecell_data with __counted_by, which instructs the UBSAN bounds sanitizer to use .num as the element count for .hws[]. In exynos_clkout_probe(), .hws[] is accessed before .num is initialized, so the sanitizer sees an element count of zero and raises an out-of-bounds warning (UBSAN: array-index-out-of-bounds in drivers/clk/samsung/clk-exynos-clkout.c:178:18, index 0 is out of range for type 'clk_hw *[*]'). The fix moves the .num initialization to before the first .hws[] access, eliminating the spurious warnings (Feedly).

The primary observable impact is a flood of UBSAN kernel log warnings during boot on Exynos-based Linux systems, which can cause boot-time instability and obscure legitimate kernel diagnostics. While the underlying improper bounds validation theoretically represents a condition that could be leveraged in attack scenarios, no practical exploitation path leading to confidentiality, integrity, or availability compromise has been demonstrated. The CVSS v3.1 score of 7.8 (High) reflects the theoretical worst-case local privilege escalation potential, but the practical impact in current observed conditions is limited to log flooding and potential boot instability on affected Samsung Exynos hardware (Feedly).

• Logs: Kernel log entries containing UBSAN: array-index-out-of-bounds in drivers/clk/samsung/clk-exynos-clkout.c:178:18 with the message index 0 is out of range for type 'clk_hw *[*]' during system boot on Exynos-based hardware — these indicate an unpatched kernel is in use (Feedly).

Apply the upstream kernel patches available via git.kernel.org stable branches. Patched versions are: 6.6.120 or later (for the 6.6.x series), 6.12.64 or later (for the 6.7–6.12 series), and 6.18.4 or later (for the 6.13+ series). No configuration-based workaround is available; upgrading to a patched kernel version is the only remediation. Prioritize patching on Exynos-based systems that exhibit boot-time UBSAN warnings in kernel logs (Feedly, MSRC).