CVE-2025-71093: Linux Kernel e1000 Buffer Overflow Flaw

CVE-2025-71093 Overview

CVE-2025-71093 is an out-of-bounds read vulnerability in the Linux kernel's e1000 network driver. The vulnerability exists in the e1000_tbi_should_accept() function, which is called from the NAPI receive path (e1000_clean_rx_irq). When processing received network frames, the function reads the last byte of the frame to evaluate the TBI (Ten Bit Interface) workaround without first validating that the descriptor-reported length is within valid bounds. If the reported length is zero or exceeds the actual RX buffer size, this results in an out-of-bounds memory access that can hit unrelated slab objects.

Critical Impact

This vulnerability allows out-of-bounds memory reads in kernel space, potentially leading to information disclosure or system instability. The issue is triggered during normal network packet processing in interrupt context.

Affected Products

• Linux kernel with e1000 network driver enabled
• Systems using Intel PRO/1000 network interface cards
• Multiple kernel stable branches prior to the security patches

Discovery Timeline

• January 13, 2026 - CVE-2025-71093 published to NVD
• January 13, 2026 - Last updated in NVD database

Technical Details for CVE-2025-71093

Vulnerability Analysis

The vulnerability occurs in the e1000 network driver's TBI workaround logic. The TBI (Ten Bit Interface) is a physical layer interface used in Gigabit Ethernet. The e1000 driver includes a workaround in e1000_tbi_should_accept() that examines the last byte of received frames to make acceptance decisions.

The problematic code pattern reads memory at position data[length - 1] without first validating that the length value from the RX descriptor is sensible. When a malformed or corrupted descriptor reports a zero length, the calculation length - 1 underflows, causing the driver to read from an invalid memory location. Similarly, if the reported length exceeds adapter->rx_buffer_len, the access goes beyond the allocated RX buffer.

KASAN (Kernel Address Sanitizer) reports confirm this is a slab-out-of-bounds read, with the buggy address located 1620 bytes beyond a 2048-byte kmalloc-2k slab object. The vulnerability is triggered from the network receive interrupt handler path, making it exploitable through specially crafted network traffic.

Root Cause

The root cause is missing input validation in the e1000_tbi_should_accept() function. The code unconditionally dereferences memory based on the descriptor-reported frame length:

u8 last_byte = *(data + length - 1);

This pattern assumes the length value is always valid and within the bounds of the allocated RX buffer. However, the descriptor length can be corrupted or intentionally manipulated, either through hardware bugs, memory corruption, or potentially through crafted network traffic that exploits edge cases in the hardware's frame length reporting.

Attack Vector

The vulnerability is triggered through the network receive path. An attacker with the ability to send network traffic to a vulnerable system could potentially craft packets that cause the e1000 hardware or driver to generate RX descriptors with invalid length values. The attack vector involves:

1. Sending specially crafted network frames to a target system with an e1000 network interface
2. The frames trigger processing through e1000_clean_rx_irq() in soft IRQ context
3. When e1000_tbi_should_accept() is called with an invalid descriptor length, an out-of-bounds read occurs
4. The memory read can access adjacent kernel slab objects, potentially leaking sensitive kernel memory or causing system instability

The KASAN stack trace shows the vulnerability being triggered during normal SSH traffic processing, indicating it can occur during legitimate network activity when certain edge conditions are met.

Detection Methods for CVE-2025-71093

Indicators of Compromise

• KASAN warnings in kernel logs indicating slab-out-of-bounds access in e1000_tbi_should_accept()
• Stack traces showing calls from e1000_clean_rx_irq to e1000_tbi_should_accept with memory access violations
• System instability or kernel panics related to e1000 network driver operations
• Unexpected memory corruption symptoms on systems using Intel PRO/1000 network adapters

Detection Strategies

• Enable KASAN (Kernel Address Sanitizer) in kernel builds to detect out-of-bounds memory accesses
• Monitor kernel logs for slab-out-of-bounds errors associated with the e1000 driver module
• Implement network traffic monitoring for anomalous packet patterns targeting e1000-equipped systems
• Use kernel debugging tools to track memory access patterns in the e1000 receive path

Monitoring Recommendations

• Configure syslog monitoring for KASAN violation reports containing e1000_tbi_should_accept
• Deploy endpoint detection and response (EDR) solutions capable of detecting kernel memory corruption events
• Monitor for unusual network traffic patterns that may indicate exploitation attempts
• Set up alerts for e1000 driver errors or unexpected network interface resets

How to Mitigate CVE-2025-71093

Immediate Actions Required

• Apply the available kernel patches from the Linux kernel stable branches immediately
• Consider disabling affected e1000 network interfaces if patching is not immediately possible
• Review systems for signs of exploitation by checking kernel logs for KASAN warnings
• Prioritize patching for systems with e1000 network adapters that handle untrusted network traffic

Patch Information

Multiple kernel patches have been released to address this vulnerability. The fix adds validation to reject frames early if the length is zero or if it exceeds adapter->rx_buffer_len. This preserves the TBI workaround semantics for valid frames while preventing memory access beyond the RX buffer bounds.

Kernel patches are available through the following commits:

• Kernel Git Commit 26c8bebc
• Kernel Git Commit 2c4c0c09
• Kernel Git Commit 9c72a518
• Kernel Git Commit ad7a2a45
• Kernel Git Commit ee7c125f

Workarounds

• If immediate patching is not feasible, consider replacing e1000 network interfaces with alternative network adapters using different drivers
• Implement network-level filtering to reduce exposure to potentially malicious traffic
• Use network segmentation to isolate systems with vulnerable e1000 interfaces from untrusted networks
• Monitor affected systems closely while awaiting patch deployment

# Check if e1000 driver is loaded on your system
lsmod | grep e1000

# View current kernel version to verify patch status
uname -r

# Monitor kernel logs for KASAN warnings
dmesg | grep -i "kasan\|e1000_tbi_should_accept"