Junglewise Threat Intelligence

CVE-2025-71112: Linux Kernel HNS3 out-of-bounds access in VLAN configuration

CVE-2025-71112 · Severity: high · CVSS 7.1 · Published 2026-01-14

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability in the Linux kernel's HNS3 network driver could allow a local attacker to cause a system crash or potentially access sensitive memory. The issue occurs when the driver processes network configuration requests from virtual machines without properly checking the validity of the VLAN ID. This affects systems using HiSilicon HNS3 network hardware, including certain industrial controllers.

Technical details

An out-of-bounds (OOB) read vulnerability exists in the Linux kernel HNS3 Ethernet driver (hclge_main.c). The root cause is a lack of validation for the VLAN ID received via a configuration mailbox from a Virtual Function (VF). When a provided VLAN ID is greater than or equal to the defined VLAN_N_VID constant, the driver performs an out-of-bounds access on the vlan_del_fail_bmap bitmap. A local attacker with the ability to trigger VF configuration can exploit this to cause a denial of service (system crash) or potentially read sensitive kernel memory. Patches have been released across multiple stable kernel branches.

Affected products

  • Linux Linux Kernel fe4144d47eef to 6ef935e65902bfed53980ad2754b06a284ea8ac1
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.6

Timeline

  • 2025-12-11: disclosed: Initial patch submission by Huawei engineers
  • 2025-12-18: patched: Mainline kernel patch committed
  • 2026-01-14: advisory: CVE-2025-71112 published

References

Related threats