CVE-2025-71197: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71197 is an off-by-one heap buffer overflow vulnerability in the Linux kernel's 1-Wire (w1) thermal subsystem, specifically in the alarms_store() sysfs handler of the w1_therm driver. The flaw was introduced in Linux kernel 5.8 and affects all versions from that point up to the patched releases. Fixed versions include Linux 6.6.122, 6.12.68, 6.18.8, and 6.19-rc7. It was published on February 4, 2026, and carries an estimated HIGH severity by Feedly; an official CVSS score has not yet been assigned (base score listed as 0.0 in ENISA data) (Feedly, ENISA EUVD).

The root cause is a classic off-by-one buffer overflow (CWE-122: Heap-based Buffer Overflow). The sysfs subsystem allocates size + 1 bytes for the input buffer and appends a NUL terminator, but the size argument passed to alarms_store() does not account for this extra byte. The original code allocated only size bytes and then used strcpy() to copy the buffer, which always writes one byte past the end of the allocation because strcpy() copies through the NUL terminator at index size. The fix eliminates the intermediate allocation entirely by parsing the buf parameter directly with simple_strtoll(), removing both the overflow and the unnecessary memory copy (Feedly).

Successful exploitation could allow a local attacker with write access to the relevant sysfs attribute to corrupt kernel heap memory, potentially leading to privilege escalation, kernel crash (denial of service), or arbitrary code execution in kernel context. Because the vulnerable sysfs node is typically writable only by privileged users or specific device-owning groups, the practical impact is constrained to local attackers with at least limited system access. Data confidentiality and integrity could be compromised if heap corruption is leveraged to escalate privileges (Feedly).

Apply the upstream kernel patches that fix this vulnerability. The corrected commits are available for the stable kernel trees, with patched releases including Linux 6.6.122, 6.12.68, 6.18.8, and 6.19-rc7. Major distributions have issued advisories and updated packages: Ubuntu has released fixes via USN-8162-1, USN-8180-1/2/4/5/6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8278-1/2, USN-8289-1/2, USN-8296-1/2, USN-8297-1, and USN-8393-1; Oracle Linux and SUSE have also issued updates. As a workaround where patching is not immediately possible, unloading the w1_therm kernel module (rmmod w1_therm) will eliminate the attack surface if 1-Wire thermal sensors are not required (Feedly, Ubuntu USN-8162-1, Ubuntu USN-8180-1).