CVE-2025-71198: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71198 is a NULL pointer dereference vulnerability in the Linux kernel's IIO (Industrial I/O) subsystem, specifically within the st_lsm6dsx IMU driver. The flaw exists because the st_lsm6dsx_acc_channels array of struct iio_chan_spec has a non-NULL event_spec field, incorrectly indicating event detection support for all sensors in the family. When userspace attempts to configure accelerometer wakeup events on a sensor that does not support them (e.g., LSM6DS0), st_lsm6dsx_write_event() dereferences a NULL pointer while attempting to write to the wakeup register. The vulnerability was published on February 4, 2026, and affects Linux kernel versions from 5.5 up to the patched stable releases. The CVSS category is estimated as Medium, with an EPSS score of approximately 0.018% (Feedly, EUVD).

The root cause is a NULL pointer dereference (CWE-476) in the st_lsm6dsx driver under drivers/iio/imu/st_lsm6dsx/. The st_lsm6dsx_acc_channels array is shared across all sensors in the LSM6DSx family, but not all sensors support IIO event detection. When a sensor without event detection capability (such as the LSM6DS0) is used and userspace writes to the event configuration interface, st_lsm6dsx_write_event() attempts to access a wakeup register pointer that is NULL for that sensor, triggering a kernel NULL pointer dereference. The fix introduces a separate iio_chan_spec array with a NULL event_spec field, which is used for sensors lacking event detection support, preventing the erroneous dereference (Feedly, Linux Kernel Patches).

Successful exploitation of this vulnerability can cause a kernel NULL pointer dereference, leading to a kernel panic and system crash, resulting in a denial of service (DoS) condition. The impact is limited to availability — confidentiality and integrity are not directly affected. Exploitation requires local access to a system with an affected LSM6DSx-family sensor (e.g., LSM6DS0) and the ability to write to the IIO event configuration interface from userspace (Feedly, EUVD).

The Linux kernel maintainers have released patches addressing this vulnerability in stable branches. Fixed versions include Linux 6.6.122, 6.12.68, 6.18.8, and 6.19-rc7, with corresponding commits available in the stable kernel tree. Users running affected kernel versions on systems with LSM6DSx-family sensors (particularly LSM6DS0) should update to a patched kernel version. Distribution-specific updates have been issued by Ubuntu (USN-8278-1, USN-8278-2, USN-8289-1, USN-8289-2, USN-8296-1, USN-8296-2, USN-8393-1) and SUSE (Ubuntu Security, Linux Kernel Patches, Feedly).