CVE-2025-71195: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71195 is a kernel crash vulnerability in the Linux kernel's DMA engine subsystem, specifically in the Xilinx XDMA driver (dmaengine: xilinx: xdma). The flaw results from the max_register field being incorrectly assigned the size of the register memory region rather than the offset of the last register, which can trigger a kernel segmentation fault when the regmap is read via debugfs. The vulnerability was published on February 4, 2026, and affects Linux kernel versions from 6.3 up to the patched stable releases. The CVSS base score is listed as 0.0 (no official score assigned), with Feedly estimating severity as Medium (Feedly).

The root cause is an off-by-one/incorrect value assignment in the Xilinx XDMA DMA engine driver, where max_register is set to the total size of the register memory region instead of the offset of the last valid register (CWE-131: Incorrect Calculation of Buffer Size). When a user or process reads from /sys/kernel/debug/regmap/xdma.1.auto/registers via debugfs, the regmap subsystem iterates up to max_register, causing regmap_mmio_read32le to access memory beyond the mapped I/O region. This results in a kernel paging fault at an invalid virtual address, as evidenced by the call trace: regmap_mmio_read32le → _regmap_bus_reg_read → _regmap_read → regmap_read → regmap_read_debugfs. The bug is present on ARM64 systems using the Xilinx XDMA IP core and is triggered by local access to the debugfs interface (Feedly).

Successful triggering of this vulnerability causes a kernel segmentation fault (panic), resulting in a denial of service — the affected system crashes or becomes unstable. The impact is limited to availability; there is no evidence of confidentiality or integrity compromise. The vulnerability requires local access to the debugfs filesystem, limiting the blast radius to systems where unprivileged or low-privileged users can access /sys/kernel/debug/, which is typically restricted to root on hardened systems (Feedly).

• Logs: Kernel oops/panic messages in /var/log/kern.log or dmesg referencing regmap_mmio_read32le, _regmap_bus_reg_read, or regmap_read_debugfs with a translation fault at a virtual address near the XDMA device mapping.
• Logs: Messages such as Unable to handle kernel paging request at virtual address followed by FSC = 0x07: level 3 translation fault and a call trace involving xdma.
• Process: The process tail (or similar) reading /sys/kernel/debug/regmap/xdma.1.auto/registers exiting with irqs disabled and preempt_count 1, noted in kernel logs as note: tail[PID] exited with irqs disabled.

The Linux kernel maintainers have released fixes in stable branches: 6.6.122, 6.12.67, 6.18.7, and 6.19-rc6. The fix corrects the max_register field assignment in the Xilinx XDMA driver to use the offset of the last register rather than the size of the memory region. Users should update to a patched kernel version as soon as possible. As a workaround, restricting access to the debugfs filesystem (e.g., mounting with debugfs inaccessible to non-root users, or unmounting /sys/kernel/debug/) will prevent triggering the vulnerability (Feedly). Ubuntu security notices USN-8278-1, USN-8289-1, USN-8296-1, USN-8296-2, USN-8278-2, and USN-8393-1 address this issue for Ubuntu users (Ubuntu USN-8278-1, Ubuntu USN-8289-1, Ubuntu USN-8296-1).