Junglewise Threat Intelligence

CVE-2025-71064: Linux Kernel HNS3 VF driver uninitialized memory in hclgevf_knic_setup

CVE-2025-71064 · Severity: info · Published 2026-01-13

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability was identified in the Linux kernel's HNS3 network driver, which is used for high-performance networking in certain hardware environments. A mismatch in how memory is allocated for network queues could leave some components uninitialized, potentially leading to system instability or unpredictable behavior. This issue affects Linux-based systems and specific Siemens industrial controllers that utilize this driver.

Technical details

A vulnerability in the HNS3 VF driver (hclgevf) was caused by inconsistent use of queue count variables during resource allocation in hclgevf_knic_setup(). Specifically, hdev->htqp was allocated using hdev->num_tqps, while kinfo->tqp was allocated using kinfo->num_tqps, which is defined as the minimum of the requested and available queues. If kinfo->num_tqps was smaller than hdev->num_tqps, elements of the hdev->htqp array remained uninitialized. This could lead to null pointer dereferences or use of uninitialized memory when the driver attempts to access these queues. The fix ensures both structures are allocated and initialized using the consistent hdev->num_tqps value.

Affected products

  • Linux Linux Kernel 4.16 to 6.13.y
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6

Timeline

  • 2025-12-11: disclosed: Initial patch authored by Jian Shen
  • 2026-01-11: patched: Patch committed to Linux stable tree
  • 2026-01-13: advisory: CVE published

References

Related threats