CVE-2025-71231 crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode
An out-of-bounds index in the Linux kernel IAA compression driver can cause invalid array access, leading to potential crashes or information leaks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-71231?
CVE-2025-71231 is a high-severity memory corruption vulnerability in Linux kernel, published on 18 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode
The local variable 'i' is initialized with -EINVAL, but the for loop immediately overwrites it and -EINVAL is never returned.
If no empty compression mode can be found, the function would return the out-of-bounds index IAA_COMP_MODES_MAX, which would cause an invalid array access in add_iaa_compression_mode().
Fix both issues by returning either a valid index or -EINVAL.
Weakness: CWE-125
Which versions are affected by CVE-2025-71231?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-71231?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-71231 being exploited?
There is no known exploitation of CVE-2025-71231 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-71231, DEBIAN-CVE-2025-71231, GHSA-mx4x-pxgm-r77w, ROOT-OS-DEBIAN-11-CVE-2025-71231, ROOT-OS-DEBIAN-12-CVE-2025-71231, ROOT-OS-UBUNTU-2404-CVE-2025-71231 and 1 more.