CVE-2025-71077
BaseFortify
Publication date: 2026-01-13
Last updated on: 2026-03-25
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 5.1 |
| linux | linux_kernel | From 5.11 (inc) to 5.15.198 (exc) |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 5.16 (inc) to 6.1.160 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.120 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.64 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.18.3 (exc) |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | 6.19 |
| linux | linux_kernel | From 5.1.1 (inc) to 5.10.248 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel involves the TPM (Trusted Platform Module) component where the function tpm2_get_pcr_allocation() does not limit the number of PCR (Platform Configuration Register) banks. Without a cap, an excessive number of banks can be specified from external input, potentially causing harm. The fix caps the number of PCR banks to eight to limit the impact of out-of-bounds values.
How can this vulnerability impact me? :
The vulnerability could allow external input to specify an excessive number of PCR banks, which may lead to unexpected behavior or harm within the TPM subsystem of the Linux kernel. By capping the number of banks to eight, the risk of damage or exploitation from out-of-bounds values is limited.