Not rated
CVE-2025-71197 In the Linux kernel, the following vulnerability has been resolved: w1: therm: Fix off-by-one buffer overflow in…
Description
In the Linux kernel, the following vulnerability has been resolved: w1: therm: Fix off-by-one buffer overflow in alarms_store The sysfs buffer passed to alarms_store() is allocated with 'size + 1' bytes and a NUL terminator is appended. However, the 'size' argument does not account for this extra byte. The original code then allocated 'size' bytes and used strcpy() to copy 'buf', which always writes one byte past the allocated buffer since strcpy() copies until the NUL terminator at index 'size'. Fix this by parsing the 'buf' parameter directly using simple_strtoll() without allocating any intermediate memory or string copying. This removes the overflow while simplifying the code.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux 6.19 | earliest → < 6.19 | 6.19 |
| Linux 6.18 | earliest → < 6.18.8 | 6.18.8 |
| Linux 6.12 | earliest → < 6.12.68 | 6.12.68 |
| Linux 6.6 | earliest → < 6.6.122 | 6.6.122 |
| Linux 6.1 | earliest → < 6.1.162 | 6.1.162 |
| Linux 5.15 | earliest → < 5.15.199 | 5.15.199 |
| Linux 5.10 | earliest → < 5.10.249 | 5.10.249 |
| Linux | 5.8 | No fix stated |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.7 → latest | No fix stated |
Show the 2 other branches Hide the 2 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 | 3.1.7 → latest | No fix stated |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.7 → latest | No fix stated |
Other CVEs of Linux
The 18300 CVEs of Linux →
CVE-2026-99284
net: skbuff: propagate shared-frag marker in skb_zerocopy()
Not rated
CVE-2026-99283
netfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
Not rated
CVE-2026-99282
net/sched: sch_teql: fix use-after-free on lower qdisc drop
Not rated
CVE-2026-99281
tun: Require CAP_NET_ADMIN to attach to an ownerless device
Not rated