CVE-2025-71196

Vulnerability

In the Linux kernel's STM32 USBPHYC driver (phy-stm32-usphyc), the probe() function validates an index property from the device tree against the number of PHY instances (usbphyc->nphys). The check uses > when it should use >=, allowing index == usbphyc->nphys to pass validation. Since the array usbphyc->phys[] has indices 0 through nphys-1, this off‑by‑one error can cause an out‑of‑bounds access [1][2].

Exploitation

The index value is read from the device tree, which is typically trusted firmware data. An attacker with the ability to supply a malicious device tree (e.g., through a compromised bootloader or firmware update) could set index equal to nphys. The driver would then access usbphyc->phys[index], reading or writing beyond the allocated array [1][2]. No further authentication or network access is needed once the malicious device tree is loaded.

Impact

This out‑of‑bounds access can lead to memory corruption, potentially causing a system crash or, under specific conditions, enabling arbitrary code execution in the kernel context. The bug is classified as a low‑severity issue because it requires control over the device tree, which is not a common attack vector [1].

Mitigation

The fix changes the comparison from > to >=, ensuring that an index equal to nphys is rejected. The patch has been applied to the stable kernel trees [1][2]. Users should update to a kernel version containing the fix to eliminate the vulnerability.