GPU VulnDB

Database/Kernel, userspace & hypervisor

Linux crypto/iaa: out-of-bounds compression-mode index when no slot is free

CVSS 7.1CVE-2025-71231Kernel, userspace & hypervisorcurated

Impact

find_empty_iaa_compression_mode() returned the out-of-bounds index IAA_COMP_MODES_MAX instead of -EINVAL when every compression-mode slot was taken, and add_iaa_compression_mode() then indexed the array with it. This is the driver for the IAA/IAX compression accelerator built into Sapphire Rapids and later Xeon server parts, which some operators enable for zswap and storage compression on GPU and HPC hosts. The reachable consequence is kernel memory corruption during compression-mode registration, which is a driver setup path rather than a per-request path - it is not something a tenant workload drives. Treat this as a host-stability fix, not a tenancy-escape.

Who can reach it

Local and privileged: registering IAA compression modes happens through driver initialisation, so it needs the ability to load or configure the iaa_crypto driver on the host. No tenant or network path is described in the record.

What to do

Update to a stable kernel carrying the fix (return a valid index or -EINVAL); four stable commits are linked. That is a kernel update and a node reboot, so drain the node first. Operators who do not enable the iaa_crypto driver are not exposed and can take this on the normal patch cycle.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-71231https://git.kernel.org/stable/c/48329301969f6d21b2ef35f678e40f72b59eac94https://git.kernel.org/stable/c/de16f5bca05cace238d237791ed1b6e9d22dab60

Related entries

All Kernel, userspace & hypervisor entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.