CVE-2025-71231: crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode
In the Linux kernel, the following vulnerability has been resolved:
crypto: iaa - Fix out-of-bounds index in findemptyiaacompressionmode
The local variable 'i' is initialized with -EINVAL, but the for loop immediately overwrites it and -EINVAL is never returned.
If no empty compression mode can be found, the function would return the out-of-bounds index IAACOMPMODESMAX, which would cause an invalid array access in addiaacompressionmode().
Fix both issues by returning either a valid index or -EINVAL.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71231?
CVE-2025-71231 has a severity rating determined by its potential impact on the Linux kernel and related systems.
How do I fix CVE-2025-71231?
To fix CVE-2025-71231, ensure that you update to the latest version of the Linux kernel that includes the patch for this vulnerability.
What systems are affected by CVE-2025-71231?
CVE-2025-71231 affects various versions of the Linux kernel, specifically those versions prior to the security patch addressing this issue.
What type of vulnerability is CVE-2025-71231?
CVE-2025-71231 is categorized as a vulnerability related to an out-of-bounds index in the Linux kernel's compression mode handling.
Is CVE-2025-71231 exploitable remotely?
CVE-2025-71231 primarily presents a local exploitation vector, affecting users with access to the affected systems.