CVE-2025-71197

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-71197", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-31T11:36:51.192Z", "datePublished": "2026-02-04T16:07:32.198Z", "dateUpdated": "2026-11-10T12:39:35.626Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T21:56:32.299Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nw1: therm: Fix off-by-one buffer overflow in alarms_store\n\nThe sysfs buffer passed to alarms_store() is allocated with 'size + 1'\nbytes and a NUL terminator is appended. However, the 'size' argument\ndoes not account for this extra byte. The original code then allocated\n'size' bytes and used strcpy() to copy 'buf', which always writes one\nbyte past the allocated buffer since strcpy() copies until the NUL\nterminator at index 'size'.\n\nFix this by parsing the 'buf' parameter directly using simple_strtoll()\nwithout allocating any intermediate memory or string copying. This\nremoves the overflow while simplifying the code."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/w1/slaves/w1_therm.c"], "versions": [{"version": "e2c94d6f572079511945e64537eb1218643f2e68", "lessThan": "49ff9b4b9deacbefa6654a0a2bcaf910c9de7e95", "status": "affected", "versionType": "git"}, {"version": "e2c94d6f572079511945e64537eb1218643f2e68", "lessThan": "060b08d72a38b158a7f850d4b83c17c2969e0f6b", "status": "affected", "versionType": "git"}, {"version": "e2c94d6f572079511945e64537eb1218643f2e68", "lessThan": "b3fc3e1f04dcc7c41787bbf08a6e0d2728e022cf", "status": "affected", "versionType": "git"}, {"version": "e2c94d6f572079511945e64537eb1218643f2e68", "lessThan": "6a5820ecfa5a76c3d3e154802c8c15f391ef442e", "status": "affected", "versionType": "git"}, {"version": "e2c94d6f572079511945e64537eb1218643f2e68", "lessThan": "6fd6d2a8e41b7f544a4d26cbd60bedf9c67893a0", "status": "affected", "versionType": "git"}, {"version": "e2c94d6f572079511945e64537eb1218643f2e68", "lessThan": "e6b2609af21b5cccc9559339591b8a2cbf884169", "status": "affected", "versionType": "git"}, {"version": "e2c94d6f572079511945e64537eb1218643f2e68", "lessThan": "761fcf46a1bd797bd32d23f3ea0141ffd437668a", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/w1/slaves/w1_therm.c"], "versions": [{"version": "5.8", "status": "affected"}, {"version": "0", "lessThan": "5.8", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.249", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.199", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.162", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.122", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.68", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.8", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.10.249"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.15.199"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.1.162"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.6.122"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.12.68"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.18.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/49ff9b4b9deacbefa6654a0a2bcaf910c9de7e95"}, {"url": "https://git.kernel.org/stable/c/060b08d72a38b158a7f850d4b83c17c2969e0f6b"}, {"url": "https://git.kernel.org/stable/c/b3fc3e1f04dcc7c41787bbf08a6e0d2728e022cf"}, {"url": "https://git.kernel.org/stable/c/6a5820ecfa5a76c3d3e154802c8c15f391ef442e"}, {"url": "https://git.kernel.org/stable/c/6fd6d2a8e41b7f544a4d26cbd60bedf9c67893a0"}, {"url": "https://git.kernel.org/stable/c/e6b2609af21b5cccc9559339591b8a2cbf884169"}, {"url": "https://git.kernel.org/stable/c/761fcf46a1bd797bd32d23f3ea0141ffd437668a"}], "title": "w1: therm: Fix off-by-one buffer overflow in alarms_store", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-11-10T12:39:35.626Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "versions": [{"status": "affected", "version": "V3.1.7", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}, {"url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}]}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/w1/slaves/w1_therm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "49ff9b4b9deacbefa6654a0a2bcaf910c9de7e95", "status": "affected", "version": "e2c94d6f572079511945e64537eb1218643f2e68", "versionType": "git"}, {"lessThan": "060b08d72a38b158a7f850d4b83c17c2969e0f6b", "status": "affected", "version": "e2c94d6f572079511945e64537eb1218643f2e68", "versionType": "git"}, {"lessThan": "b3fc3e1f04dcc7c41787bbf08a6e0d2728e022cf", "status": "affected", "version": "e2c94d6f572079511945e64537eb1218643f2e68", "versionType": "git"}, {"lessThan": "6a5820ecfa5a76c3d3e154802c8c15f391ef442e", "status": "affected", "version": "e2c94d6f572079511945e64537eb1218643f2e68", "versionType": "git"}, {"lessThan": "6fd6d2a8e41b7f544a4d26cbd60bedf9c67893a0", "status": "affected", "version": "e2c94d6f572079511945e64537eb1218643f2e68", "versionType": "git"}, {"lessThan": "e6b2609af21b5cccc9559339591b8a2cbf884169", "status": "affected", "version": "e2c94d6f572079511945e64537eb1218643f2e68", "versionType": "git"}, {"lessThan": "761fcf46a1bd797bd32d23f3ea0141ffd437668a", "status": "affected", "version": "e2c94d6f572079511945e64537eb1218643f2e68", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/w1/slaves/w1_therm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"lessThan": "5.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.249", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.199", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.162", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.122", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.68", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.6", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "V3.1.7", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nw1: therm: Fix off-by-one buffer overflow in alarms_store\n\nThe sysfs buffer passed to alarms_store() is allocated with 'size + 1'\nbytes and a NUL terminator is appended. However, the 'size' argument\ndoes not account for this extra byte. The original code then allocated\n'size' bytes and used strcpy() to copy 'buf', which always writes one\nbyte past the allocated buffer since strcpy() copies until the NUL\nterminator at index 'size'.\n\nFix this by parsing the 'buf' parameter directly using simple_strtoll()\nwithout allocating any intermediate memory or string copying. This\nremoves the overflow while simplifying the code."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nw1: therm: Correcci\u00f3n de desbordamiento de b\u00fafer por un byte en alarms_store\n\nEl b\u00fafer sysfs pasado a alarms_store() se asigna con 'size + 1' bytes y se a\u00f1ade un terminador NUL. Sin embargo, el argumento 'size' no tiene en cuenta este byte adicional. El c\u00f3digo original entonces asignaba 'size' bytes y usaba strcpy() para copiar 'buf', lo que siempre escribe un byte m\u00e1s all\u00e1 del b\u00fafer asignado ya que strcpy() copia hasta el terminador NUL en el \u00edndice 'size'.\n\nEsto se soluciona analizando el par\u00e1metro 'buf' directamente usando simple_strtoll() sin asignar ninguna memoria intermedia ni copiar cadenas. Esto elimina el desbordamiento mientras simplifica el c\u00f3digo."}], "id": "CVE-2025-71197", "lastModified": "2026-11-10T13:18:08.763", "metrics": {}, "published": "2026-02-04T17:16:11.633", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/060b08d72a38b158a7f850d4b83c17c2969e0f6b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/49ff9b4b9deacbefa6654a0a2bcaf910c9de7e95"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6a5820ecfa5a76c3d3e154802c8c15f391ef442e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6fd6d2a8e41b7f544a4d26cbd60bedf9c67893a0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/761fcf46a1bd797bd32d23f3ea0141ffd437668a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b3fc3e1f04dcc7c41787bbf08a6e0d2728e022cf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e6b2609af21b5cccc9559339591b8a2cbf884169"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: w1: therm: Fix off-by-one buffer overflow in alarms_store", "id": "2436793", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436793"}, "csaw": false, "details": ["No description is available for this CVE."], "name": "CVE-2025-71197", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-71197\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-71197\nhttps://lore.kernel.org/linux-cve-announce/2026020412-CVE-2025-71197-cfe2@gregkh/T"]}

{}