e1000: fix OOB in e1000_tbi_should_accept()
In the Linux kernel, the following vulnerability has been resolved: e1000: fix OOB in e1000_tbi_should_accept() In e1000_tbi_should_accept() we read the last byte of the frame via 'data[length - 1]' to evaluate the TBI workaround. If the descriptor- reported length is zero or larger than the actual RX buffer size, this read goes out of bounds and can hit unrelated slab objects. The issue is observed from the NAPI receive path (e1000_clean_rx_irq): ================================================================== BUG: KASAN: slab-out-of-bounds in e1000_tbi_should_accept+0x610/0x790 Read of size 1 at addr ffff888014114e54 by task sshd/363 CPU: 0 PID: 363 Comm: sshd Not tainted 5.18.0-rc1 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x5a/0x74 print_address_description+0x7b/0x440 print_report+0x101/0x200 kasan_report+0xc1/0xf0 e1000_tbi_should_accept+0x610/0x790 e1000_clean_rx_irq+0xa8c/0x1110 e1000_clean+0xde2/0x3c10 __napi_poll+0x98/0x380 net_rx_action+0x491/0xa20 __do_softirq+0x2c9/0x61d do_softirq+0xd1/0x120 __local_bh_enable_ip+0xfe/0x130 ip_finish_output2+0x7d5/0xb00 __ip_queue_xmit+0xe24/0x1ab0 __tcp_transmit_skb+0x1bcb/0x3340 tcp_write_xmit+0x175d/0x6bd0 __tcp_push_pending_frames+0x7b/0x280 tcp_sendmsg_locked+0x2e4f/0x32d0 tcp_sendmsg+0x24/0x40 sock_write_iter+0x322/0x430 vfs_write+0x56c/0xa60 ksys_write+0xd1/0x190 do_syscall_64+0x43/0x90 entry_SYSCALL_64_after_hwframe+0
CVE-2025-71093
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2025-71093
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2037110c96d5f1dd71453fcd0d54e79be12a352b",
"lessThan": "4ccfa56f272241e8d8e2c38191fdbb03df489d80",
"versionType": "git"
},
{
"status": "affected",
"version": "2037110c96d5f1dd71453fcd0d54e79be12a352b",
"lessThan": "278b7cfe0d4da7502c7fd679b15032f014c92892",
"versionType": "git"
},
{
"status": "affected",
"version": "2037110c96d5f1dd71453fcd0d54e79be12a352b",
"lessThan": "ad7a2a45e2417ac54089926b520924f8f0d91aea",
"versionType": "git"
},
{
"status": "affected",
"version": "2037110c96d5f1dd71453fcd0d54e79be12a352b",
"lessThan": "2c4c0c09f9648ba766d399917d420d03e7b3e1f8",
"versionType": "git"
},
{
"status": "affected",
"version": "2037110c96d5f1dd71453fcd0d54e79be12a352b",
"lessThan": "26c8bebc2f25288c2bcac7bc0a7662279a0e817c",
"versionType": "git"
},
{
"status": "affected",
"version": "2037110c96d5f1dd71453fcd0d54e79be12a352b",
"lessThan": "ee7c125fb3e8b04dd46510130b9fc92380e5d578",
"versionType": "git"
},
{
"status": "affected",
"version": "2037110c96d5f1dd71453fcd0d54e79be12a352b",
"lessThan": "9c72a5182ed92904d01057f208c390a303f00a0f",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/ethernet/intel/e1000/e1000_main.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.18"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.18",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.248",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.198",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.160",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.120",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.64",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.4",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/ethernet/intel/e1000/e1000_main.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2025-71093
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #39148 · Revision 1
- Added to Heist Feed
- Publisher date