CVE-2025-71231: Linux Kernel Buffer Overflow Vulnerability

CVE-2025-71231 Overview

CVE-2025-71231 is an out-of-bounds index vulnerability in the Linux kernel's Intel Analytics Accelerator (IAA) crypto driver. The flaw resides in the find_empty_iaa_compression_mode() function within the crypto/iaa subsystem. The local variable i is initialized with -EINVAL, but the for loop immediately overwrites it. When no empty compression mode slot is available, the function returns the out-of-bounds index IAA_COMP_MODES_MAX instead of an error. This invalid index propagates to add_iaa_compression_mode(), triggering an invalid array access [CWE-125]. The issue affects systems using the IAA hardware compression driver on supported Intel platforms.

Critical Impact
A local authenticated attacker can trigger out-of-bounds memory access in the kernel, leading to high confidentiality exposure and full denial of service on affected Linux hosts.

Affected Products

Linux Kernel (mainline) — IAA crypto driver (crypto/iaa)
Stable kernel branches prior to commits 48329301, c77b33b5, d7520746, and de16f5bc
Linux distributions shipping the IAA accelerator driver on Intel Xeon platforms

Discovery Timeline

2026-02-18 - CVE-2025-71231 published to NVD
2026-03-18 - Last updated in NVD database

Technical Details for CVE-2025-71231

Vulnerability Analysis

The vulnerability exists in find_empty_iaa_compression_mode(), a helper routine that searches the iaa_compression_modes[] array for an unused slot. The function declares the index variable i and initializes it to -EINVAL as a sentinel error value. The subsequent for loop assignment unconditionally overwrites the sentinel before any comparison, defeating the intended error-return semantics.

When the array contains no free entry, control falls through the loop with i equal to IAA_COMP_MODES_MAX, the array's upper bound. The caller, add_iaa_compression_mode(), treats this returned value as a valid array index and dereferences iaa_compression_modes[IAA_COMP_MODES_MAX]. The access reads memory beyond the declared array bounds, classified as CWE-125 (Out-of-Bounds Read).

The upstream fix returns either a valid index or -EINVAL explicitly, restoring the intended contract between caller and callee. See Kernel Git Commit 4832930 for the canonical patch.

Root Cause

The root cause is a logic error in error-path handling. The sentinel initialization is shadowed by loop-variable assignment, and no post-loop bounds check validates i before the function returns. The defective contract allows the caller to consume an invalid index as if it were a successful lookup result.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker with permission to interact with the IAA crypto interface can drive the kernel into a state where all compression mode slots are populated, then trigger add_iaa_compression_mode() to force the out-of-bounds access. The result is kernel memory disclosure or a kernel panic, producing host-wide denial of service.

No exploitation code or public proof-of-concept has been published, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-71231

Indicators of Compromise

Unexpected kernel oops or panic messages referencing find_empty_iaa_compression_mode or add_iaa_compression_mode in dmesg or /var/log/kern.log.
KASAN (Kernel Address Sanitizer) reports flagging out-of-bounds reads in the crypto/iaa module.
Repeated module load attempts or crypto API calls from non-root user contexts targeting the IAA driver.

Detection Strategies

Inventory running kernel versions against the fixed commits listed in the upstream stable tree and flag hosts that have not received the patch.
Monitor kernel ring buffer output for IAA driver faults and correlate with the originating process and user.
Audit which workloads load the iaa_crypto module and restrict the attack surface to known-trusted services.

Monitoring Recommendations

Forward kernel logs to a centralized SIEM and alert on crash signatures involving the IAA crypto code path.
Track CPU and accelerator telemetry on Intel platforms exposing IAA to detect anomalous compression-mode registration activity.
Validate patch deployment status across the fleet using configuration management tooling and kernel version reporting.

How to Mitigate CVE-2025-71231

Immediate Actions Required

Apply the upstream stable kernel update containing the fix as soon as your distribution publishes a patched build.
Restrict local access on systems that expose the IAA crypto driver, particularly multi-tenant or shared-compute hosts.
Disable or unload the iaa_crypto kernel module on systems that do not require hardware-accelerated compression.

Patch Information

The fix is committed to the upstream Linux kernel and backported to stable branches. Apply the kernel rebuild containing one of the following commits: Kernel Git Commit 4832930, Kernel Git Commit c77b33b, Kernel Git Commit d752074, or Kernel Git Commit de16f5b. The patch replaces the faulty return value with either a validated array index or -EINVAL.

Workarounds

Blacklist the iaa_crypto module via /etc/modprobe.d/ on hosts that do not require IAA acceleration.
Limit access to crypto API surfaces by tightening Linux capabilities and seccomp profiles for untrusted workloads.
Use kernel lockdown mode where supported to reduce the local attack surface against kernel modules.

bash

# Configuration example: blacklist the IAA crypto module until patched
echo "blacklist iaa_crypto" | sudo tee /etc/modprobe.d/disable-iaa-crypto.conf
sudo modprobe -r iaa_crypto 2>/dev/null || true
sudo update-initramfs -u