CVE-2025-71195: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-71195 Overview

A vulnerability has been identified in the Linux kernel's Xilinx XDMA DMA engine driver where the max_register field is incorrectly assigned the size of the register memory region instead of the offset of the last register. This misconfiguration allows out-of-bounds memory access when reading from the regmap via debugfs, resulting in a kernel segmentation fault and system instability.

Critical Impact

Reading from the regmap via debugfs can cause a kernel segmentation fault, leading to denial of service and potential system crash on affected ARM64 systems using Xilinx XDMA hardware.

Affected Products

• Linux kernel with Xilinx XDMA DMA engine driver
• ARM64 systems using xdma regmap debugfs interface
• Systems with Xilinx programmable logic utilizing XDMA IP

Discovery Timeline

• 2026-02-04 - CVE CVE-2025-71195 published to NVD
• 2026-02-05 - Last updated in NVD database

Technical Details for CVE-2025-71195

Vulnerability Analysis

The vulnerability exists in the Xilinx XDMA driver's regmap configuration. When initializing the regmap structure, the driver incorrectly assigns the total size of the register memory region to the max_register field rather than the actual offset of the last valid register. This fundamental misconfiguration creates a boundary condition where the regmap subsystem believes it can access registers beyond the actual mapped memory region.

When a user or debugging tool attempts to read registers through the debugfs interface (specifically /sys/kernel/debug/regmap/xdma.1.auto/registers), the regmap subsystem iterates through what it believes are valid register offsets. Once access exceeds the actual mapped memory boundary, the kernel attempts to dereference an invalid virtual address, triggering a level 3 translation fault (FSC = 0x07) as the MMU cannot translate the unmapped address.

The call trace reveals the fault path: regmap_mmio_read32le → _regmap_bus_reg_read → _regmap_read → regmap_read → regmap_read_debugfs, confirming the issue occurs during debugfs-initiated register reads.

Root Cause

The root cause is an incorrect value assignment to the max_register field in the regmap configuration structure. The developer mistakenly used the total byte size of the register memory region instead of calculating the correct offset to the last accessible register. In regmap terminology, max_register should represent the highest valid register offset, not the memory region size. This off-by-one-region error results in the regmap allowing access attempts to memory beyond the legitimate register space.

Attack Vector

The vulnerability can be triggered by any user with sufficient privileges to access the debugfs filesystem. The attack vector requires local access to the system with permissions to read from /sys/kernel/debug/regmap/. An attacker or even legitimate debugging operations can trigger the fault by reading from the affected regmap's register dump file.

The exploitation path involves:

1. Mounting or accessing the debugfs filesystem
2. Reading from /sys/kernel/debug/regmap/xdma.1.auto/registers
3. The read operation causes the kernel to access memory outside the valid register region
4. A level 3 translation fault occurs, resulting in kernel panic or segmentation fault

The kernel crash trace shows the fault occurring at virtual address ffff800082f70000 with an ESR (Exception Syndrome Register) value of 0x0000000096000007, indicating a data abort from the current exception level due to a translation fault.

Detection Methods for CVE-2025-71195

Indicators of Compromise

• Kernel panic or oops messages referencing regmap_mmio_read32le in the call trace
• Segmentation faults occurring when accessing /sys/kernel/debug/regmap/xdma*/registers
• System log entries showing "Unable to handle kernel paging request" with XDMA-related virtual addresses
• Unexpected process terminations when using tools like tail or cat on XDMA regmap debugfs files

Detection Strategies

• Monitor kernel logs for ESR values 0x0000000096000007 with FSC 0x07 (level 3 translation fault) associated with regmap operations
• Implement alerting on kernel oops messages containing xdma or regmap_mmio_read in the stack trace
• Deploy file integrity monitoring on debugfs access patterns to detect exploitation attempts

Monitoring Recommendations

• Enable kernel crash dump collection to capture full diagnostic information when faults occur
• Configure system logging to capture detailed kernel messages at debug level for DMA engine subsystems
• Implement real-time kernel log analysis for translation fault patterns on ARM64 systems with Xilinx FPGA hardware

How to Mitigate CVE-2025-71195

Immediate Actions Required

• Apply the kernel patches from the stable kernel tree immediately
• Restrict access to debugfs filesystem by adjusting mount permissions or using debugfs=off kernel parameter if regmap debugging is not required
• Limit user access to the /sys/kernel/debug/regmap/ directory through file system permissions

Patch Information

The Linux kernel maintainers have released patches to fix this vulnerability across multiple stable kernel branches. The fix correctly calculates the max_register value as the offset of the last valid register rather than using the memory region size.

Patches are available at the following kernel git commits:

• Kernel Git Commit 5e7ad32
• Kernel Git Commit 606ea96
• Kernel Git Commit c7d436a
• Kernel Git Commit df8a131

Workarounds

• Disable debugfs entirely by adding debugfs=off to kernel boot parameters if debugging capabilities are not needed
• Restrict debugfs mount to root-only access using appropriate mount options and file permissions
• Unload the xilinx_xdma module if Xilinx XDMA functionality is not actively required on the system

# Disable debugfs at boot (add to kernel command line)
debugfs=off

# Alternatively, restrict debugfs permissions after boot
chmod 700 /sys/kernel/debug
chmod 700 /sys/kernel/debug/regmap

# Unload XDMA module if not needed
modprobe -r xilinx_xdma