CyberSecBulletin
CVE-2025-71086NVD status: Modified

Linux: Improper Validation of Array Index

Published Updated By the CyberSecBulletin desk

CVE-2025-71086 is a high-severity improper validation of array index vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 819fb41ae54960f66025802400c9d3935eef4042, ed2639414d43ba037f798eaf619e878309310451, 1418c12cd3bba79dc56b57b61c99efe40f579981 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.15% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 819fb41ae54960f66025802400c9d3935eef4042 or ed2639414d43ba037f798eaf619e878309310451 or 1418c12cd3bba79dc56b57b61c99efe40f579981 or 9f6185a32496834d6980b168cffcccc2d6b17280, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 4.20 or 5.5 or 5.10.248 or 5.15.198, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux12e5a4719c99d7f4104e7e962393dfb8baa1c591 up to, but not including, 819fb41ae54960f66025802400c9d3935eef4042; c0e527c532a07556ca44642f5873b002c44da22c up to, but not including, ed2639414d43ba037f798eaf619e878309310451; 3e0d1585799d8a991eba9678f297fd78d9f1846e up to, but not including, 1418c12cd3bba79dc56b57b61c99efe40f579981; ffced26692f83212aa09d0ece0213b23cc2f611d up to, but not including, 9f6185a32496834d6980b168cffcccc2d6b17280; 64b8bc7d5f1434c636a40bdcfcd42b278d1714be up to, but not including, b409ba9e1e63ccf3ab4cc061e33c1f804183543e; 64b8bc7d5f1434c636a40bdcfcd42b278d1714be up to, but not including, 92d900aac3a5721fb54f3328f1e089b44a861c38; 64b8bc7d5f1434c636a40bdcfcd42b278d1714be up to, but not including, 6595beb40fb0ec47223d3f6058ee40354694c8e4; bd7de4734535140fda33240c2335a07fdab6f88e; and 8 more ranges819fb41ae54960f66025802400c9d3935eef4042, ed2639414d43ba037f798eaf619e878309310451, 1418c12cd3bba79dc56b57b61c99efe40f579981, 9f6185a32496834d6980b168cffcccc2d6b17280, b409ba9e1e63ccf3ab4cc061e33c1f804183543e, 92d900aac3a5721fb54f3328f1e089b44a861c38
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)V3.1.6 and later; V3.1.7 and laterNot stated
SiemensSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)V3.1.6 and later; V3.1.7 and laterNot stated
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)V3.1.6 and later; V3.1.7 and laterNot stated
SiemensSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)V3.1.6 and later; V3.1.7 and laterNot stated
SiemensSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)V3.1.6 and later; V3.1.7 and laterNot stated
LinuxLinux Kernel4.19.304 up to, but not including, 4.20; 5.4.266 up to, but not including, 5.5; 5.10.206 up to, but not including, 5.10.248; 5.15.146 up to, but not including, 5.15.198; 6.1.70 up to, but not including, 6.1.160; 6.6.9 up to, but not including, 6.6.120; 6.7.1 up to, but not including, 6.12.64; 6.13 up to, but not including, 6.18.4; and 2 more ranges4.20, 5.5, 5.10.248, 5.15.198, 6.1.160, 6.6.120

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: net: rose: fix invalid array index in rose_kill_by_device() rose_kill_by_device() collects sockets into a local array[] and then iterates over them to disconnect sockets bound to a device being brought down. The loop mistakenly indexes array[cnt] instead of array[i]. For cnt < ARRAY_SIZE(array), this reads an uninitialized entry; for cnt == ARRAY_SIZE(array), it is an out-of-bounds read. Either case can lead to an invalid socket pointer dereference and also leaks references taken via sock_hold(). Fix the index to use i.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Improper Validation of Array Index

The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

How developers prevent this class of flaw

  • Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
  • Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, Ada allows the programmer to constrain the values of a variable and languages such as Java and Ruby will allow the programmer to handle exceptions when an out-of-bounds index is accessed.
  • Use a CPU and operating system that offers Data Execution Protection (using hardware NX or XD bits) or the equivalent techniques that simulate this feature in software, such as PaX. These techniques ensure that any instruction executed is exclusively at a memory address that is part of the code segment. For more information on these techniques see D3-PSEP (Process Segment Execution Prevention) from D3FEND.

More Improper Validation of Array Index vulnerabilities (CWE-129)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Recent Improper Validation of Array Index vulnerabilities

Spotted an error? Tell us.