CVE-2025-71122

iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED

syzkaller found it could overflow math in the test infrastructure and cause a WARN_ON by corrupting the reserved interval tree. This only effects test kernels with CONFIG_IOMMUFD_TEST.

Validate the user input length in the test ioctl.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.22%Up 0.2 points since Jan 15, 2026

What each source reports

NVD Score used 7.8

In the Linux kernel, the following vulnerability has been resolved:

iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED

syzkaller found it could overflow math in the test infrastructure and cause a WARN_ON by corrupting the reserved interval tree. This only effects test kernels with CONFIG_IOMMUFD_TEST.

Validate the user input length in the test ioctl.

Record: CVE-2025-71122
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-05

CVE List No score

iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED

In the Linux kernel, the following vulnerability has been resolved:

iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED

syzkaller found it could overflow math in the test infrastructure and cause a WARN_ON by corrupting the reserved interval tree. This only effects test kernels with CONFIG_IOMMUFD_TEST.

Validate the user input length in the test ioctl.

Record: CVE-2025-71122
Updated: 2026-11-05

EUVDEUVD-2026-2489 No score

In the Linux kernel, the following vulnerability has been resolved:

iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED

syzkaller found it could overflow math in the test infrastructure and cause a WARN_ON by corrupting the reserved interval tree. This only effects test kernels with CONFIG_IOMMUFD_TEST.

Validate the user input length in the test ioctl.

Record: EUVD-2026-2489
Updated: 2026-11-05

GitHub AdvisoriesGHSA-rgpf-6q47-j6p9 7.8

In the Linux kernel, the following vulnerability has been resolved: iommufd/selftest: Check for...

In the Linux kernel, the following vulnerability has been resolved:

iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED

syzkaller found it could overflow math in the test infrastructure and cause a WARN_ON by corrupting the reserved interval tree. This only effects test kernels with CONFIG_IOMMUFD_TEST.

Validate the user input length in the test ioctl.

Record: GHSA-rgpf-6q47-j6p9
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVBELL-CVE-2025-71122 7.8

Record: BELL-CVE-2025-71122
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2025-71122 7.8

In the Linux kernel, the following vulnerability has been resolved: iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED syzkaller found it could overflow math in the test infrastructure and cause a WARN_ON by corrupting the reserved interval tree. This only effects test kernels with CONFIG_IOMMUFD_TEST. Validate the user input length in the test ioctl.

Record: DEBIAN-CVE-2025-71122
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

Show 24 moreShow less

OSVROOT-OS-UBUNTU-2404-CVE-2025-71122 7.8

CVE-2025-71122 in linux - Patched by Root

Root has patched CVE-2025-71122 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2025-71122
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2025-71122 7.8

Record: UBUNTU-CVE-2025-71122
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVCLSA-2026-1782155469 No score

kernel: Fix of 143 CVEs

ice: Fix PTP NULL pointer dereference during VSI rebuild {CVE-2026-23210}
tracing: Add recursion protection in kernel stack trace recording {CVE-2026-23138}
mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() {CVE-2025-38681}
cpuset: fix warning when disabling remote partition {CVE-2025-71142}
virtio: break and reset virtio devices on device_shutdown() {CVE-2025-38064}
netdevsim: fix a race issue related to the operation on bpf_bound_progs list {CVE-2026-23126}
atm: clip: Fix potential null-ptr-deref in to_atmarpd(). {CVE-2025-38460}
idpf: fix error handling in the init_task on load {CVE-2026-23017}
rxrpc: Fix recvmsg() unconditional requeue {CVE-2026-23066}
block: zero non-PI portion of auto integrity buffer {CVE-2026-23007}
can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode {CVE-2025-38665}
virtio_net: Fix napi_skb_cache_put warning {CVE-2024-43835}
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() {CVE-2026-23169}
net: fix segmentation of forwarding fraglist GRO {CVE-2026-23154}
gfs2: Validate i_depth for exhash directories {CVE-2025-38710}
KVM: Don't clobber irqfd routing type when deassigning irqfd {CVE-2026-23198}
ipvlan: Make the addrs_lock be per port {CVE-2026-23103}
xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
can: mcp251xfd: fix infinite loop when xmit fails {CVE-2024-41088}
RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly {CVE-2025-71096}
RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction {CVE-2025-38161}
scsi: qla2xxx: Validate sp before freeing associated memory {CVE-2025-71236}
net/sched: netem: account for backlog updates from child qdisc {CVE-2024-56770}
drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat {CVE-2026-31656}
iavf: fix off-by-one issues in iavf_config_rss_reg() {CVE-2025-71087}
net/sched: ets: fix divide by zero in the offload path {CVE-2026-23379}
can: j1939: implement NETDEV_UNREGISTER notification handler {CVE-2025-39925}
ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() {CVE-2026-31531}
Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb {CVE-2026-31510}
ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() {CVE-2026-23003}
drm/i915/gt: Check set_default_submission() before deferencing {CVE-2026-31540}
mac802154: check local interfaces before deleting sdata list {CVE-2024-57948}
lib/buildid: use __kernel_read() for sleepable context {CVE-2026-23002}
scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs {CVE-2023-52808}
net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}
irqchip/imx-irqsteer: Handle runtime power management correctly {CVE-2024-42290}
io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop {CVE-2026-23113}
net/sched: ets: Remove drr class from the active list if it changes to strict {CVE-2025-68815}
net: bonding: fix NULL deref in bond_debug_rlb_hash_show {CVE-2026-31546}
ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}
openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}
net: USB: Fix wrong-direction WARNING in plusb.c {CVE-2023-52742}
module: Fix kernel panic when a symbol st_shndx is out of bounds {CVE-2026-31521}
udf: Fix preallocation discarding at indirect extent boundary {CVE-2022-48946}
net/mlx5: qos: Restrict RTNL area to avoid a lock cycle {CVE-2025-39947}
scsi: core: Wake up the error handler when final completions race against each other {CVE-2026-23110}
nbd: don't allow reconnect after disconnect {CVE-2025-21731}
nfsd: check that server is running in unlock_filesystem {CVE-2026-22989}
af_key: validate families in pfkey_send_migrate() {CVE-2026-31515}
netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() {CVE-2024-36286} -…

Record: CLSA-2026-1782155469
Updated: 2026-11-02

OSV No score

iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED

In the Linux kernel, the following vulnerability has been resolved:

iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED

syzkaller found it could overflow math in the test infrastructure and cause a WARN_ON by corrupting the reserved interval tree. This only effects test kernels with CONFIG_IOMMUFD_TEST.

Validate the user input length in the test ioctl.

Record: CVE-2025-71122
Updated: 2026-11-07

OSVMGASA-2026-0017 No score

Updated kernel, kmod-virtualbox & kmod-xtables-addons packages fix security vulnerabilities

Upstream kernel version 6.6.120 fixes bugs and vulnerabilities. The kmod-virtualbox & kmod-xtables-addons packages have been updated to work with this new kernel.

Record: MGASA-2026-0017
Updated: 2026-11-02

OSVMGASA-2026-0018 No score

Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.6.120 fixes bugs and vulnerabilities. For information about the vulnerabilities see the links.

Record: MGASA-2026-0018
Updated: 2026-11-02

OSVUSN-8177-1 No score

linux, linux-realtime vulnerabilities

Josh Eads, Kristoffer Janke, Eduardo Vela Nava, Tavis Ormandy, and Matteo Rizzo discovered that some AMD Zen processors did not properly verify the signature of CPU microcode. This flaw is known as EntrySign. A privileged attacker could possibly use this issue to cause load malicious CPU microcode causing loss of integrity and confidentiality. (CVE-2024-36347)