CVE-2025-71197
Unknown Unknown - Not Provided

Off-by-One Buffer Overflow in Linux Kernel w1 Therm Component

Publication date: 2026-02-04

Last updated on: 2026-02-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: w1: therm: Fix off-by-one buffer overflow in alarms_store The sysfs buffer passed to alarms_store() is allocated with 'size + 1' bytes and a NUL terminator is appended. However, the 'size' argument does not account for this extra byte. The original code then allocated 'size' bytes and used strcpy() to copy 'buf', which always writes one byte past the allocated buffer since strcpy() copies until the NUL terminator at index 'size'. Fix this by parsing the 'buf' parameter directly using simple_strtoll() without allocating any intermediate memory or string copying. This removes the overflow while simplifying the code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-02-04
Last Modified
2026-02-06
Generated
2026-07-06
AI Q&A
2026-02-04
EPSS Evaluated
2026-07-05
NVD
CVE-2025-71197

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an off-by-one buffer overflow in the Linux kernel's w1 therm driver, specifically in the alarms_store function. The issue arises because the buffer passed to alarms_store() is allocated with 'size + 1' bytes to include a NUL terminator, but the 'size' argument does not account for this extra byte. The original code allocated only 'size' bytes and used strcpy() to copy the buffer, which copies until the NUL terminator, causing it to write one byte beyond the allocated buffer.

The fix involved changing the code to parse the input buffer directly using simple_strtoll() without allocating intermediate memory or copying strings, thereby removing the overflow and simplifying the code.

Impact Analysis

An off-by-one buffer overflow can potentially lead to memory corruption, which might be exploited by an attacker to cause a denial of service (system crash) or possibly execute arbitrary code with kernel privileges. This could compromise system stability and security.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71197. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart