Junglewise Threat Intelligence

CVE-2025-71130: Linux Kernel i915 DRM NULL pointer dereference in i915_gem_do_execbuffer

CVE-2025-71130 · Severity: high · CVSS 7.8 · Published 2026-01-14

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's Intel graphics driver (i915) that could allow a local user to crash the system. The issue occurs when the driver fails to properly clean up memory during certain graphics processing tasks. This can lead to a system instability or a complete crash, potentially allowing an attacker to gain elevated privileges.

Technical details

A NULL pointer dereference vulnerability exists in the i915 GEM component of the Linux kernel, specifically within the i915_gem_do_execbuffer function. The eb.vma array was previously initialized with slab poison values rather than being zero-initialized. If eb_add_vma() fails during eb_lookup_vmas(), the subsequent cleanup routine eb_release_vmas() may attempt to dereference uninitialized pointers because it relies on NULL values to identify the end of the valid array entries. This local vulnerability can be triggered by a standard user and results in a kernel oops or denial of service. The fix involves explicitly zero-initializing the eb.vma array using memset at the start of the execution buffer setup.

Affected products

  • Linux Linux Kernel 5.16 to 6.18.4

Timeline

  • 2025-12-16: patched: Initial patch submitted by Intel
  • 2026-01-14: advisory: CVE-2025-71130 published

References

Related threats