CVE-2025-71197

Vulnerability

In the Linux kernel's w1 subsystem, the alarms_store() function, a buffer overflow occurs due to an off-by-one error. The sysfs buffer is allocated with size + 1 bytes and a NUL terminator is appended, but the [1]. However, the size argument does not account for this extra byte, so the original code allocated only size bytes and used strcpy() to copy the buffer, which always writes one byte past the allocated buffer because strcpy() copies until the NUL terminator at index size [1].

Exploitation

This vulnerability is exploitable via the sysfs interface, which is typically accessible to local users with write permissions to the alarms attribute of a file. An attacker could craft a malicious input that triggers the overflow, potentially leading to memory corruption [1].

Impact

A successful exploit could allow a local attacker to corrupt kernel memory, potentially leading to a denial of service (system crash) or, in some cases, privilege escalation [1].

Mitigation

The fix has been applied to the Linux kernel stable tree [1]. Users should update to a patched kernel version. No workaround is available other than applying the patch.