CVE-2025-71093

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

e1000: fix OOB in e1000_tbi_should_accept()

In e1000_tbi_should_accept() we read the last byte of the frame via

'data[length - 1]' to evaluate the TBI workaround. If the descriptor-

reported length is zero or larger than the actual RX buffer size, this

read goes out of bounds and can hit unrelated slab objects. The issue

is observed from the NAPI receive path (e1000_clean_rx_irq):

==================================================================

BUG: KASAN: slab-out-of-bounds in e1000_tbi_should_accept+0x610/0x790

Read of size 1 at addr ffff888014114e54 by task sshd/363

CPU: 0 PID: 363 Comm: sshd Not tainted 5.18.0-rc1 #1

Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014

Call Trace:

<IRQ>

dump_stack_lvl+0x5a/0x74

print_address_description+0x7b/0x440

print_report+0x101/0x200

kasan_report+0xc1/0xf0

e1000_tbi_should_accept+0x610/0x790

e1000_cle

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References