PT-2026-2622 · Linux+2 · Linux Kernel+2

Published 2026-01-13 · Updated 2026-05-11 · CVE-2025-71101

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The hp populate * elements from package() functions within the hp-bioscfg driver contain out-of-bounds array access issues. These functions parse ACPI packages, and a flaw exists in how array indices are validated during the processing of multi-element fields like PREREQUISITES and ENUM POSSIBLE VALUES. The original bounds check only verified the elem variable, failing to account for additional offsets (reqs or pos values) when accessing array elements, potentially leading to memory corruption. The fix modifies the bounds check to validate the actual accessed index.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2025-71101

MGASA-2026-0017

MGASA-2026-0018

OPENSUSE-SU-2026:20287-1

SUSE-SU-2026:0447-1

SUSE-SU-2026:0472-1

SUSE-SU-2026:0587-1

SUSE-SU-2026:20555-1

SUSE-SU-2026:20599-1

SUSE-SU-2026:20615-1

USN-8177-1

USN-8177-2

USN-8179-1

USN-8179-2

USN-8179-3

USN-8179-4

USN-8183-1

USN-8183-2

USN-8184-1

USN-8185-1

USN-8185-2

USN-8203-1

USN-8204-1

USN-8245-1

USN-8257-1

USN-8258-1

USN-8260-1

USN-8261-1

USN-8265-1

Affected Products

Linuxmint

Linux Kernel

Ubuntu

References · 1256

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71101.json · Exploit
• https://ubuntu.com/security/CVE-2025-71095 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68244 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68340 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68745 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40321 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-71117 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8203-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40051 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68307 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68758 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68337 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68818 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40315 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-39829 · Vendor Advisory