In the Linux kernel, the following vulnerability has been resolved:

net: hns3: add VLAN id validation before using

Currently, the VLAN id may be used without validation when
receive a VLAN configuration mailbox from VF. The length of
vlan_del_fail_bmap is BITS_TO_LONGS(VLAN_N_VID). It may cause
out-of-bounds memory access once the VLAN id is bigger than
or equal to VLAN_N_VID.

Therefore, VLAN id needs to be checked to ensure it is within
the range of VLAN_N_VID.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00053.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
fe4144d47eef8453459c53a34e9d5940a3e6c219 affected < 46c7d9fe8dd869ea5de666aba8c1ec1061ca44a8
fe4144d47eef8453459c53a34e9d5940a3e6c219 affected < 42c91dfa772c57de141e5a55a187ac760c0fd7e1
fe4144d47eef8453459c53a34e9d5940a3e6c219 affected < 00e56a7706e10b3d00a258d81fcb85a7e96372d6
fe4144d47eef8453459c53a34e9d5940a3e6c219 affected < b7b4f3bf118f51b67691a55b464f04452e5dc6fc
fe4144d47eef8453459c53a34e9d5940a3e6c219 affected < 95cca255a7a5ad782639ff0298c2a486707d1046
fe4144d47eef8453459c53a34e9d5940a3e6c219 affected < 91a51d01be5c9f82c12c2921ca5cceaa31b67128
fe4144d47eef8453459c53a34e9d5940a3e6c219 affected < 6ef935e65902bfed53980ad2754b06a284ea8ac1
Linux Linux affected
Version Status Constraints
5.3 affected —
0 unaffected < 5.3
5.10.248 unaffected ≤ 5.10.*
5.15.198 unaffected ≤ 5.15.*
6.1.160 unaffected ≤ 6.1.*
6.6.120 unaffected ≤ 6.6.*
6.12.64 unaffected ≤ 6.12.*
6.18.3 unaffected ≤ 6.18.*
6.19 unaffected ≤ *

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.3:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories
Source ID Title
Debian DLA Debian DLA DLA-4475-1 linux security update
Debian DLA Debian DLA DLA-4476-1 linux-6.1 security update
Debian DSA Debian DSA DSA-6126-1 linux security update
Debian DSA Debian DSA DSA-6127-1 linux security update
Ubuntu USN Ubuntu USN USN-8096-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8096-2 Linux kernel (FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-8096-3 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8096-4 Linux kernel (Real-time) vulnerabilities
Ubuntu USN Ubuntu USN USN-8096-5 Linux kernel (NVIDIA Tegra IGX) vulnerabilities
Ubuntu USN Ubuntu USN USN-8116-1 Linux kernel (Intel IoTG Real-time) vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/00e56a7706e10b3d00a258d81fcb85a7e96372d6 cve-icon cve-icon
https://git.kernel.org/stable/c/42c91dfa772c57de141e5a55a187ac760c0fd7e1 cve-icon cve-icon
https://git.kernel.org/stable/c/46c7d9fe8dd869ea5de666aba8c1ec1061ca44a8 cve-icon cve-icon
https://git.kernel.org/stable/c/6ef935e65902bfed53980ad2754b06a284ea8ac1 cve-icon cve-icon
https://git.kernel.org/stable/c/91a51d01be5c9f82c12c2921ca5cceaa31b67128 cve-icon cve-icon
https://git.kernel.org/stable/c/95cca255a7a5ad782639ff0298c2a486707d1046 cve-icon cve-icon
https://git.kernel.org/stable/c/b7b4f3bf118f51b67691a55b464f04452e5dc6fc cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2026011413-CVE-2025-71112-ca37@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-71112 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-71112 cve-icon
History

Wed, 25 Mar 2026 20:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
CPEs cpe:2.3:o:linux:linux_kernel:5.3:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'}

Mon, 19 Jan 2026 12:45:00 +0000

Type Values Removed Values Added
References

Thu, 15 Jan 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Wed, 14 Jan 2026 15:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net: hns3: add VLAN id validation before using Currently, the VLAN id may be used without validation when receive a VLAN configuration mailbox from VF. The length of vlan_del_fail_bmap is BITS_TO_LONGS(VLAN_N_VID). It may cause out-of-bounds memory access once the VLAN id is bigger than or equal to VLAN_N_VID. Therefore, VLAN id needs to be checked to ensure it is within the range of VLAN_N_VID.
Title net: hns3: add VLAN id validation before using
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-02-09T08:35:06.680Z

Reserved: 2026-01-13T15:30:19.653Z

Link: CVE-2025-71112

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-01-14T15:16:00.313

Modified: 2026-03-25T19:59:29.587

Link: CVE-2025-71112

cve-icon Redhat

Severity : Important

Publid Date: 2026-01-14T00:00:00Z

Links: CVE-2025-71112 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses