CVE-2025-71196
Off-by-One Vulnerability in Linux stm32-usphyc USB PHY Probe
Publication date: 2026-02-04
Last updated on: 2026-02-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an off-by-one error in the Linux kernel's stm32-usphyc driver during the probe() function.
Specifically, the 'index' variable is used to access elements in the usbphyc->phys[] array, which has usbphyc->nphys elements.
If 'index' equals usbphyc->nphys, it goes one element out of bounds, which is an invalid access.
The 'index' value comes from the device tree, which is generally trusted, but the bug was fixed by changing the condition from '>' to '>=' to prevent this out-of-bounds access.
How can this vulnerability impact me? :
I don't know
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know