Skip to content
Heist/ feed
Critical

e1000: fix OOB in e1000_tbi_should_accept()

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: e1000: fix OOB in e1000_tbi_should_accept() In e1000_tbi_should_accept() we read the last byte of the frame via 'data[length - 1]' to evaluate the TBI workaround. If the descriptor- reported length is zero or larger than the actual RX buffer size, this read goes out of bounds and can hit unrelated slab objects. The issue is observed from the NAPI receive path (e1000_clean_rx_irq): ================================================================== BUG: KASAN: slab-out-of-bounds in e1000_tbi_should_accept+0x610/0x790 Read of size 1 at addr ffff888014114e54 by task sshd/363 CPU: 0 PID: 363 Comm: sshd Not tainted 5.18.0-rc1 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x5a/0x74 print_address_description+0x7b/0x440 print_report+0x101/0x200 kasan_report+0xc1/0xf0 e1000_tbi_should_accept+0x610/0x790 e1000_clean_rx_irq+0xa8c/0x1110 e1000_clean+0xde2/0x3c10 __napi_poll+0x98/0x380 net_rx_action+0x491/0xa20 __do_softirq+0x2c9/0x61d do_softirq+0xd1/0x120 __local_bh_enable_ip+0xfe/0x130 ip_finish_output2+0x7d5/0xb00 __ip_queue_xmit+0xe24/0x1ab0 __tcp_transmit_skb+0x1bcb/0x3340 tcp_write_xmit+0x175d/0x6bd0 __tcp_push_pending_frames+0x7b/0x280 tcp_sendmsg_locked+0x2e4f/0x32d0 tcp_sendmsg+0x24/0x40 sock_write_iter+0x322/0x430 vfs_write+0x56c/0xa60 ksys_write+0xd1/0x190 do_syscall_64+0x43/0x90 entry_SYSCALL_64_after_hwframe+0

Announced Source revision 1
Original source ↗

CVE-2025-71093

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2025-71093

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "2037110c96d5f1dd71453fcd0d54e79be12a352b",
        "lessThan": "4ccfa56f272241e8d8e2c38191fdbb03df489d80",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "2037110c96d5f1dd71453fcd0d54e79be12a352b",
        "lessThan": "278b7cfe0d4da7502c7fd679b15032f014c92892",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "2037110c96d5f1dd71453fcd0d54e79be12a352b",
        "lessThan": "ad7a2a45e2417ac54089926b520924f8f0d91aea",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "2037110c96d5f1dd71453fcd0d54e79be12a352b",
        "lessThan": "2c4c0c09f9648ba766d399917d420d03e7b3e1f8",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "2037110c96d5f1dd71453fcd0d54e79be12a352b",
        "lessThan": "26c8bebc2f25288c2bcac7bc0a7662279a0e817c",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "2037110c96d5f1dd71453fcd0d54e79be12a352b",
        "lessThan": "ee7c125fb3e8b04dd46510130b9fc92380e5d578",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "2037110c96d5f1dd71453fcd0d54e79be12a352b",
        "lessThan": "9c72a5182ed92904d01057f208c390a303f00a0f",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "drivers/net/ethernet/intel/e1000/e1000_main.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "3.18"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "3.18",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.248",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.198",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.160",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.120",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.64",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.4",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "6.19",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "drivers/net/ethernet/intel/e1000/e1000_main.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2025-71093

Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event
#39148 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement