{"id":"CVE-2025-71122","title":"iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\niommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED\n\nsyzkaller found it could overflow math in the test infrastructure and\ncause a WARN_ON by corrupting …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= f4b20bb34c83dceade5470288f48f94ce3598ada < 4cc829d61f10c20523fd4085c1546e741a792a97","Linux >= f4b20bb34c83dceade5470288f48f94ce3598ada < e6c122cffcbb2e84d321ec8ba0e38ce8e7c10925","Linux >= f4b20bb34c83dceade5470288f48f94ce3598ada < b166b8e0a381429fefd9180e67fbc834b3cee82f","Linux >= f4b20bb34c83dceade5470288f48f94ce3598ada < e6a973af11135439de32ece3b9cbe3bfc043bea8","Linux 6.2"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T21:14:27.670652Z"},"published":"2026-01-14","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:23:08.986Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-71122","references":[{"url":"https://git.kernel.org/stable/c/4cc829d61f10c20523fd4085c1546e741a792a97"},{"url":"https://git.kernel.org/stable/c/e6c122cffcbb2e84d321ec8ba0e38ce8e7c10925"},{"url":"https://git.kernel.org/stable/c/b166b8e0a381429fefd9180e67fbc834b3cee82f"},{"url":"https://git.kernel.org/stable/c/e6a973af11135439de32ece3b9cbe3bfc043bea8"}],"tags":["cve.org"],"epss":0.00217,"epssPercentile":0.12296,"ingestedAt":"2026-11-05T22:38:32.051Z","slug":"CVE-2025-71122","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED\n\nsyzkaller found it could overflow math in the test infrastructure and\ncause a WARN_ON by corrupting the reserved interval tree. This only\neffects test kernels with CONFIG_IOMMUFD_TEST.\n\nValidate the user input length in the test ioctl.\n\n## Affected\n\n- `Linux >= f4b20bb34c83dceade5470288f48f94ce3598ada < 4cc829d61f10c20523fd4085c1546e741a792a97`\n- `Linux >= f4b20bb34c83dceade5470288f48f94ce3598ada < e6c122cffcbb2e84d321ec8ba0e38ce8e7c10925`\n- `Linux >= f4b20bb34c83dceade5470288f48f94ce3598ada < b166b8e0a381429fefd9180e67fbc834b3cee82f`\n- `Linux >= f4b20bb34c83dceade5470288f48f94ce3598ada < e6a973af11135439de32ece3b9cbe3bfc043bea8`\n- `Linux 6.2`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}