LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71231: crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode

In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode The local variable 'i' is initialized with -EINVAL, but the for loop immediately overwrites it and -EINVAL is never returned. If no empty compression mode can be found, the function would return the out-of-bounds index IAA_COMP_MODES_MAX, which would cause an invalid array access in add_iaa_compression_mode(). Fix both issues by returning either a valid index or -EINVAL.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

A Linux kernel bug in the crypto IAA compression mode code could return an invalid array index when no free compression mode is available. The public record does not provide CVSS, impact rating, or confirmed exploit activity, so business urgency depends on whether affected kernels and this code path are present.

Executive priority

Handle through normal kernel vulnerability management unless your environment depends on affected IAA compression functionality. Escalate priority if a vendor advisory later assigns high impact, confirms reachable exposure, or reports exploitation.

Technical view

find_empty_iaa_compression_mode initialized a variable to -EINVAL, then overwrote it in the loop. When no empty mode existed, it could return IAA_COMP_MODES_MAX, causing invalid array access in add_iaa_compression_mode(). The resolved fix returns only a valid index or -EINVAL.

Likely exposure

Exposure appears limited to Linux kernels containing the vulnerable crypto IAA code. The source bundle lists Linux kernel versions and commits but does not provide distro package mappings, hardware prerequisites, or affected configuration details.

Exploitation context

The provided sources do not report active exploitation, public exploit code, KEV inclusion, CVSS, or a CWE. Treat exploitability and impact as unconfirmed until kernel or distribution advisories provide more operational detail.

Researcher notes

The record documents an out-of-bounds index leading to invalid array access, but not the security consequence. Validation should focus on kernel lineage, backported fix status, and whether the IAA compression mode path can be reached in local configurations.

Mitigation direction

  • Review Linux kernel and distribution advisories for CVE-2025-71231.
  • Update to a kernel build containing one of the referenced stable fixes.
  • Prioritize systems using affected Linux kernels and crypto IAA functionality.
  • If patching is delayed, check vendor guidance for supported mitigations.

Validation and detection

  • Inventory Linux kernel versions across servers and appliances.
  • Map running kernels to vendor advisories for CVE-2025-71231.
  • Confirm patched builds include the referenced stable kernel commits.
  • Check whether crypto IAA functionality is present or enabled.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71231 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxb190447e0fa3ef7355480d641d078962e03768b4, b190447e0fa3ef7355480d641d078962e03768b4, b190447e0fa3ef7355480d641d078962e03768b4, b190447e0fa3ef7355480d641d078962e03768b4unaffected
LinuxLinux6.8, 0, 6.12.72, 6.18.11, 6.19.1, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.