CVE-2025-71231: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71231 is an out-of-bounds read vulnerability in the Linux kernel's crypto IAA (Intel Analytics Accelerator) compression module. The flaw exists in the find_empty_iaa_compression_mode() function, which can return an out-of-bounds index (IAA_COMP_MODES_MAX) instead of -EINVAL when no empty compression mode slot is available, leading to invalid array access in add_iaa_compression_mode(). It affects Linux kernel versions 6.8 through 6.12.71, 6.13 through 6.18.10, and 6.19.0. It was disclosed on February 18, 2026, and carries a CVSS v3.1 base score of 7.1 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a logic error (CWE-125: Out-of-bounds Read) in find_empty_iaa_compression_mode() within the kernel's IAA crypto driver. The local variable i is initialized to -EINVAL, but the for loop immediately overwrites it; if the loop exhausts all slots without finding an empty one, the function returns IAA_COMP_MODES_MAX — an out-of-bounds index — rather than the intended error code. This invalid index is then passed to add_iaa_compression_mode(), which uses it to access an array, resulting in an out-of-bounds memory read. The attack vector is local, requiring low privileges and no user interaction, making it exploitable by any unprivileged local user on an affected system (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation can result in kernel memory corruption, potentially leading to a denial of service (system crash) or unauthorized disclosure of sensitive kernel memory contents. A local attacker with low privileges could leverage the out-of-bounds read to access confidential kernel data or destabilize the system, with high impacts to both confidentiality and availability. Integrity is not directly impacted by this read-class vulnerability (Red Hat Advisory, Red Hat Bugzilla).

The Linux kernel stable branches have been patched; users should upgrade to kernel version 6.12.72 or later, 6.18.11 or later, or 6.19.1 or later. Downstream distributions including Debian, SUSE, and Oracle Linux have issued updated kernel packages incorporating this fix. If immediate patching is not feasible, restrict local user access to affected systems and consider disabling IAA compression functionality if it is not operationally required (Red Hat Advisory, Red Hat Bugzilla).