CVE-2025-71087

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iavf: fix off-by-one issues in iavf_config_rss_reg()

There are off-by-one bugs when configuring RSS hash key and lookup

table, causing out-of-bounds reads to memory [1] and out-of-bounds

writes to device registers.

Before commit 43a3d9ba34c9 ("i40evf: Allow PF driver to configure RSS"),

the loop upper bounds were:

i <= I40E_VFQF_{HKEY,HLUT}_MAX_INDEX

which is safe since the value is the last valid index.

That commit changed the bounds to:

i <= adapter->rss_{key,lut}_size / 4

where `rss_{key,lut}_size / 4` is the number of dwords, so the last

valid index is `(rss_{key,lut}_size / 4) - 1`. Therefore, using `<=`

accesses one element past the end.

Fix the issues by using `<` instead of `<=`, ensuring we do not exceed

the bounds.

[1] KASAN splat about rss_key_size off-by-one

BUG: KASAN: slab-out-of-bounds in iavf_config_rss+0x619/0x800

Read of size 4 at addr ffff888102c50134 by task kworker/u8:6/63

CPU:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References