CVE-2025-71197
Unknown Unknown - Not Provided
Off-by-One Buffer Overflow in Linux Kernel w1 Therm Component

Publication date: 2026-02-04

Last updated on: 2026-02-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: w1: therm: Fix off-by-one buffer overflow in alarms_store The sysfs buffer passed to alarms_store() is allocated with 'size + 1' bytes and a NUL terminator is appended. However, the 'size' argument does not account for this extra byte. The original code then allocated 'size' bytes and used strcpy() to copy 'buf', which always writes one byte past the allocated buffer since strcpy() copies until the NUL terminator at index 'size'. Fix this by parsing the 'buf' parameter directly using simple_strtoll() without allocating any intermediate memory or string copying. This removes the overflow while simplifying the code.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-02-04
Last Modified
2026-02-06
Generated
2026-06-16
AI Q&A
2026-02-04
EPSS Evaluated
2026-06-14
NVD
CVE-2025-71197
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an off-by-one buffer overflow in the Linux kernel's w1 therm driver, specifically in the alarms_store function. The issue arises because the buffer passed to alarms_store() is allocated with 'size + 1' bytes to include a NUL terminator, but the 'size' argument does not account for this extra byte. The original code allocated only 'size' bytes and used strcpy() to copy the buffer, which copies until the NUL terminator, causing it to write one byte beyond the allocated buffer.

The fix involved changing the code to parse the input buffer directly using simple_strtoll() without allocating intermediate memory or copying strings, thereby removing the overflow and simplifying the code.

Impact Analysis

An off-by-one buffer overflow can potentially lead to memory corruption, which might be exploited by an attacker to cause a denial of service (system crash) or possibly execute arbitrary code with kernel privileges. This could compromise system stability and security.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-71197. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart