CVE-2025-71196: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71196 is an off-by-one error in the Linux kernel's phy: stm32-usphyc driver, specifically in the probe() function. The bug causes the index variable — sourced from the device tree — to be used as an array index into usbphyc->phys[] without proper bounds checking, allowing access one element beyond the array's valid range (usbphyc->nphys elements). The vulnerability was published on February 4, 2026, and affects Linux kernel versions from 4.17 up to the patched stable releases. Feedly estimates the severity as Medium, with an EPSS score of 0.00018 (Feedly).

The root cause is a classic off-by-one bounds check error (CWE-193) in the STM32 USB PHY controller driver's probe() function. The original code used a > comparison instead of >= when validating the index variable against usbphyc->nphys, meaning an index equal to nphys would pass the check and access memory one element past the end of the usbphyc->phys[] array. The index value originates from device tree data, which is generally trusted but not guaranteed to be correct, making this a low-probability but valid out-of-bounds access scenario. The fix is a one-character change replacing > with >= in the bounds check (Feedly).

Exploitation of this vulnerability could result in out-of-bounds memory access within the Linux kernel, potentially leading to kernel memory corruption, system instability, or a denial of service (kernel panic/crash). Because the index is derived from device tree configuration — typically set at build or boot time — the practical exploitability is limited to scenarios where an attacker can influence device tree content or where the device tree is misconfigured. There is no evidence of confidentiality or integrity impact beyond local kernel memory corruption on affected STM32-based embedded systems (Feedly).

The Linux kernel maintainers have released patches addressing this vulnerability across multiple stable branches. Fixed versions include Linux 6.6.122, 6.12.67, 6.18.7, and 6.19-rc6, as well as commits 76b870fdaad8, b91c9f6bfb04, 7c27eaf18356, and cabd25b57216 in the stable kernel tree. Downstream distributions including Ubuntu (USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8278-1, USN-8289-1, USN-8296-1, USN-8297-1) and SUSE have also issued updated kernel packages. Users should update to the latest patched kernel version for their distribution (Ubuntu Security, Feedly).