CVE-2025-71121: Linux Kernel ASP Chip DoS Vulnerability

CVE-2025-71121 Overview

CVE-2025-71121 is a vulnerability in the Linux kernel affecting the PA-RISC architecture, specifically systems using the ASP (Auxiliary System Processor) chip found in legacy HP workstations such as the HP 730. The vulnerability exists in the interrupt affinity reprogramming code path, where attempting to reprogram affinity on ASP chips causes a High Priority Machine Check (HPMC) system crash. The ASP chip is an older variant of the GSP chip and lacks the expected register layout at standard memory locations, causing fatal hardware exceptions when the kernel attempts to access these non-existent registers.

Critical Impact

Systems running the Linux kernel on HP PA-RISC workstations with ASP chips can experience complete system crashes (HPMC) when interrupt affinity reprogramming is triggered, leading to denial of service.

Affected Products

• Linux kernel (PA-RISC architecture with ASP chip)
• HP 730 workstations and similar legacy PA-RISC systems
• Systems with GSP chip variants using ASP architecture

Discovery Timeline

• 2026-01-14 - CVE CVE-2025-71121 published to NVD
• 2026-01-19 - Last updated in NVD database

Technical Details for CVE-2025-71121

Vulnerability Analysis

This vulnerability represents a hardware compatibility issue in the Linux kernel's PA-RISC architecture support code. The ASP (Auxiliary System Processor) chip, found in older HP workstations like the HP 730 series, is a legacy variant of the more common GSP (General System Processor) chip. While the kernel code assumes a standard register layout for interrupt affinity programming, the ASP chip does not conform to this expectation.

When the kernel attempts to reprogram interrupt affinity on systems with ASP chips, it accesses memory-mapped registers that either don't exist or are located at different addresses than expected. This causes the PA-RISC hardware to trigger a High Priority Machine Check (HPMC), which is a fatal hardware exception that results in an immediate system crash. The crash is particularly problematic because HPMC errors typically indicate severe hardware-level issues and result in complete system halt.

The irony of this vulnerability is that the affinity reprogramming functionality is entirely unnecessary on affected systems—the HP 730 is a single-CPU machine where interrupt affinity configuration serves no practical purpose. The fix implemented in the kernel adds a version check (sversion) to identify ASP chips and bypass the problematic affinity reprogramming code path entirely.

Root Cause

The root cause is the lack of hardware detection logic to differentiate between ASP chips and standard GSP chips in the PA-RISC interrupt affinity code. The kernel code assumes all GSP-family chips have compatible register layouts for affinity programming, but the ASP variant has registers at different locations or entirely absent. This missing hardware variant check allows unsafe register accesses that trigger fatal HPMC exceptions.

Attack Vector

This vulnerability can be triggered through normal system operations that invoke interrupt affinity reprogramming on affected PA-RISC systems with ASP chips. While the attack vector is local and requires specific legacy hardware, any operation that triggers affinity changes—such as CPU hotplug operations, IRQ balancing, or administrative configuration changes via /proc/irq/*/smp_affinity—could cause a complete system crash. The denial of service impact is significant on affected systems as it results in immediate, unrecoverable system failure.

The vulnerability mechanism involves the kernel's interrupt controller driver attempting to write to memory-mapped I/O registers for affinity configuration. On ASP chips, these register addresses either map to undefined memory regions or have different semantics, causing the PA-RISC processor to raise an HPMC exception. The fix adds a conditional check for the chip's sversion identifier to skip affinity programming entirely on ASP hardware, recognizing that single-CPU systems don't benefit from this functionality.

Detection Methods for CVE-2025-71121

Indicators of Compromise

• System crashes with HPMC (High Priority Machine Check) errors on PA-RISC systems
• Kernel panic logs indicating interrupt affinity operations immediately before failure
• System instability on HP 730 workstations or similar legacy PA-RISC hardware during IRQ configuration changes

Detection Strategies

• Monitor system logs for HPMC exceptions on PA-RISC architecture systems
• Check kernel version against patched releases that include the sversion check for ASP chips
• Audit systems for legacy HP PA-RISC workstations (HP 730 series) that may be vulnerable

Monitoring Recommendations

• Implement alerting for unexpected system reboots on PA-RISC systems
• Monitor /var/log/messages or dmesg output for interrupt affinity-related errors
• Track kernel version compliance across PA-RISC infrastructure to ensure patched versions are deployed

How to Mitigate CVE-2025-71121

Immediate Actions Required

• Update the Linux kernel to a patched version that includes the ASP chip detection fix
• Avoid manual interrupt affinity configuration on affected PA-RISC systems until patched
• Consider isolating critical workloads from systems running on legacy HP PA-RISC hardware with ASP chips

Patch Information

The Linux kernel developers have released patches that add a check for the ASP chip's sversion identifier to bypass the problematic affinity reprogramming code path. Multiple kernel stable branches have received this fix:

• Kernel Git Commit 4d0858b
• Kernel Git Commit 60560d1
• Kernel Git Commit 7a146f3
• Kernel Git Commit 845a92b
• Kernel Git Commit c8f810e
• Kernel Git Commit dca7da2
• Kernel Git Commit e09fd2e

Update your kernel using your distribution's package manager to obtain the patched version.

Workarounds

• Refrain from modifying interrupt affinity settings via /proc/irq/*/smp_affinity on affected systems
• Disable automatic IRQ balancing services (e.g., irqbalance) on vulnerable PA-RISC systems
• For critical systems, consider migrating workloads to modern hardware until patching is complete

# Disable irqbalance service on affected systems as a temporary workaround
systemctl stop irqbalance
systemctl disable irqbalance

# Verify kernel version after patching
uname -r