Executive brief
A vulnerability exists in the Linux kernel's Intel graphics driver (i915) that could allow a local user to crash the system. The issue occurs when the driver fails to properly clean up memory during certain graphics processing tasks. This can lead to a system instability or a complete crash, potentially allowing an attacker to gain elevated privileges.
Technical details
A NULL pointer dereference vulnerability exists in the i915 GEM component of the Linux kernel, specifically within the i915_gem_do_execbuffer function. The eb.vma array was previously initialized with slab poison values rather than being zero-initialized. If eb_add_vma() fails during eb_lookup_vmas(), the subsequent cleanup routine eb_release_vmas() may attempt to dereference uninitialized pointers because it relies on NULL values to identify the end of the valid array entries. This local vulnerability can be triggered by a standard user and results in a kernel oops or denial of service. The fix involves explicitly zero-initializing the eb.vma array using memset at the start of the execution buffer setup.
Affected products
- Linux Linux Kernel 5.16 to 6.18.4
Timeline
- 2025-12-16: patched: Initial patch submitted by Intel
- 2026-01-14: advisory: CVE-2025-71130 published
References
- https://git.kernel.org/stable/c/0336188cc85d0eab8463bd1bbd4ded4e9602de8b
- https://git.kernel.org/stable/c/24d55ac8e31d2f8197bfad71ffcb3bae21ed7117
- https://git.kernel.org/stable/c/25d69e07770745992387c016613fd7ac8eaf9893
- https://git.kernel.org/stable/c/4fe2bd195435e71c117983d87f278112c5ab364c
- https://git.kernel.org/stable/c/63f23aa2fbb823c8b15a29269fde220d227ce5b3