CVE-2025-71064: Linux Kernel Privilege Escalation Flaw

CVE-2025-71064 Overview

CVE-2025-71064 is a vulnerability in the Linux kernel's HNS3 (HiSilicon Network Subsystem 3) virtual function (VF) driver that results in uninitialized memory access. The vulnerability occurs due to an inconsistency in how resources are allocated for transmit/receive queue pairs (TQPs) between the host device (hdev->htqp) and kernel information structures (kinfo->tqp).

Critical Impact

This vulnerability can lead to uninitialized memory being accessed in the HNS3 VF driver, potentially causing system instability, kernel crashes, or unpredictable behavior in network operations on affected systems using HiSilicon network hardware.

Affected Products

• Linux kernel with HNS3 VF driver enabled
• Systems utilizing HiSilicon Network Subsystem 3 hardware
• Virtual function configurations using the hclgevf driver

Discovery Timeline

• January 13, 2026 - CVE CVE-2025-71064 published to NVD
• January 13, 2026 - Last updated in NVD database

Technical Details for CVE-2025-71064

Vulnerability Analysis

The vulnerability exists in the HNS3 VF driver's resource allocation mechanism within the hclgevf_knic_setup() function. The core issue stems from a mismatch in array sizing between two critical data structures used for managing transmit/receive queue pairs.

In the vulnerable code path, hdev->htqp is allocated based on hdev->num_tqps, while kinfo->tqp allocation uses kinfo->num_tqps. The problem arises because kinfo->num_tqps is set to min(new_tqps, hdev->num_tqps), meaning it can be smaller than hdev->num_tqps. When this condition occurs, some elements in the hdev->htqp[] array remain uninitialized after the setup function completes.

Uninitialized memory in kernel drivers represents a serious concern as it can lead to unpredictable behavior when the driver later attempts to access these queue pair structures. The memory may contain stale or arbitrary data that could cause crashes, memory corruption, or potentially be leveraged in more sophisticated attacks.

Root Cause

The root cause is an inconsistent use of different TQP count variables when allocating related data structures. The code uses hdev->num_tqps for one allocation and kinfo->num_tqps for another, despite these structures being interdependent. Since kinfo->num_tqps can be smaller due to the min() operation, this creates a scenario where some hdev->htqp[i] entries beyond the kinfo->num_tqps index are never initialized during hclgevf_knic_setup().

Attack Vector

The attack vector for this vulnerability is currently unknown. This is a kernel-level memory initialization issue in a network driver that requires specific HiSilicon hardware to be present. Exploitation would likely require local access to a system with the affected hardware and driver configuration. The vulnerability could potentially be triggered through network operations that cause the driver to access the uninitialized queue pair structures.

Detection Methods for CVE-2025-71064

Indicators of Compromise

• Kernel panic or oops messages referencing hclgevf or HNS3 VF driver functions
• Unexpected behavior in network interfaces using HiSilicon Network Subsystem 3 hardware
• Memory corruption warnings in kernel logs related to the HNS3 driver subsystem
• System instability when configuring or using virtual function network interfaces

Detection Strategies

• Monitor kernel logs (dmesg) for warnings or errors related to hclgevf driver operations
• Implement kernel memory debugging tools such as KASAN (Kernel Address Sanitizer) to detect uninitialized memory access
• Deploy runtime monitoring for unexpected kernel driver behavior on systems with HiSilicon network hardware
• Use static analysis tools on kernel configurations to identify systems running vulnerable driver versions

Monitoring Recommendations

• Enable kernel logging verbosity for network driver subsystems
• Configure alerts for kernel oops or panic events on systems with HNS3 hardware
• Monitor network interface stability metrics on affected systems
• Track driver initialization sequences for anomalies during system boot or module loading

How to Mitigate CVE-2025-71064

Immediate Actions Required

• Update the Linux kernel to a patched version that addresses this vulnerability
• Review systems for HiSilicon HNS3 network hardware and prioritize patching
• Consider disabling or unloading the hclgevf module on systems where VF functionality is not required
• Implement defense-in-depth measures including kernel hardening options

Patch Information

The Linux kernel development team has released patches to address this vulnerability. The fix ensures that both hdev->htqp and kinfo->tqp are allocated using hdev->num_tqps, maintaining consistent array lengths and ensuring all elements are properly initialized.

Multiple kernel commits have been published to stable kernel branches:

• Kernel Patch Update
• Kernel Commit Change
• Kernel Code Modification
• Kernel Security Improvement
• Kernel Commit Enhancements

Workarounds

• Unload the hclgevf kernel module if HNS3 virtual function support is not required: modprobe -r hclgevf
• Blacklist the driver module by adding blacklist hclgevf to /etc/modprobe.d/blacklist.conf
• For systems requiring HNS3 VF functionality, restrict access to kernel module configuration
• Apply network segmentation to limit exposure of potentially affected systems

# Configuration example
# Blacklist the hclgevf module to prevent loading
echo "blacklist hclgevf" >> /etc/modprobe.d/blacklist-hns3vf.conf

# Unload the module if currently loaded
modprobe -r hclgevf

# Verify module is not loaded
lsmod | grep hclgevf