CVE-2025-71300

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-71300", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-08T13:14:33.087Z", "datePublished": "2026-05-08T13:15:21.406Z", "dateUpdated": "2026-08-05T12:12:43.409Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:12:43.409Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"arm64: zynqmp: Add an OP-TEE node to the device tree\"\n\nThis reverts commit 06d22ed6b6635b17551f386b50bb5aaff9b75fbe.\n\nOP-TEE logic in U-Boot automatically injects a reserved-memory\nnode along with optee firmware node to kernel device tree.\nThe injection logic is dependent on that there is no manually\ndefined optee node. Having the node in zynqmp.dtsi effectively\nbreaks OP-TEE's insertion of the reserved-memory node, causing\nmemory access violations during runtime."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - An attacker with local code execution can reach the failure through ordinary memory-allocation paths and, in static shared-memory deployments, through normal TEE-device ioctls; no network or physical access is required.\nAC:L - Once the affected ZynqMP OP-TEE boot flow is present, the attacker controls memory pressure or shared-memory allocation without needing an uncontrollable race or victim state.\nPR:L - An unprivileged local process can create memory pressure through ordinary mappings, and the normal TEE client interface has no capability check where device permissions permit client access.\nUI:N - The attacker can trigger allocations and access the conflicting physical pages directly, without another user performing any action.\nS:U - The resulting corruption, privilege escalation, or denial of service affects the Linux kernel and host resources within the same security authority.\nC:H - In supported static-shared-memory configurations, the missing reservation lets Linux's buddy allocator and the OP-TEE pool own the same physical pages, allowing mapped TEE shared memory to expose sensitive kernel or process data.\nI:H - The overlapping ownership provides attacker-writable aliases to pages that Linux can use for kernel objects or other allocations, making arbitrary corruption and control-flow hijacking plausible.\nA:H - Linux may allocate secure OP-TEE pages as normal RAM, causing synchronous external aborts and kernel crashes, while shared-memory aliasing can independently produce fatal memory corruption."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/boot/dts/xilinx/zynqmp.dtsi"], "versions": [{"version": "06d22ed6b6635b17551f386b50bb5aaff9b75fbe", "lessThan": "eece81eeda10eb42c687399fb5aa69977ae15664", "status": "affected", "versionType": "git"}, {"version": "06d22ed6b6635b17551f386b50bb5aaff9b75fbe", "lessThan": "3983ef126e439900bbf419724a9759863c146660", "status": "affected", "versionType": "git"}, {"version": "06d22ed6b6635b17551f386b50bb5aaff9b75fbe", "lessThan": "2a833c730d4e8d1cc10953270ce0f3a156145d81", "status": "affected", "versionType": "git"}, {"version": "06d22ed6b6635b17551f386b50bb5aaff9b75fbe", "lessThan": "c197179990124f991fca220d97fac56779a02c6d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/arm64/boot/dts/xilinx/zynqmp.dtsi"], "versions": [{"version": "6.9", "status": "affected"}, {"version": "0", "lessThan": "6.9", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.75", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.16", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.6", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.12.75"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.18.16"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "6.19.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.9", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/eece81eeda10eb42c687399fb5aa69977ae15664"}, {"url": "https://git.kernel.org/stable/c/3983ef126e439900bbf419724a9759863c146660"}, {"url": "https://git.kernel.org/stable/c/2a833c730d4e8d1cc10953270ce0f3a156145d81"}, {"url": "https://git.kernel.org/stable/c/c197179990124f991fca220d97fac56779a02c6d"}], "title": "Revert \"arm64: zynqmp: Add an OP-TEE node to the device tree\"", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/arm64/boot/dts/xilinx/zynqmp.dtsi"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "eece81eeda10eb42c687399fb5aa69977ae15664", "status": "affected", "version": "06d22ed6b6635b17551f386b50bb5aaff9b75fbe", "versionType": "git"}, {"lessThan": "3983ef126e439900bbf419724a9759863c146660", "status": "affected", "version": "06d22ed6b6635b17551f386b50bb5aaff9b75fbe", "versionType": "git"}, {"lessThan": "2a833c730d4e8d1cc10953270ce0f3a156145d81", "status": "affected", "version": "06d22ed6b6635b17551f386b50bb5aaff9b75fbe", "versionType": "git"}, {"lessThan": "c197179990124f991fca220d97fac56779a02c6d", "status": "affected", "version": "06d22ed6b6635b17551f386b50bb5aaff9b75fbe", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/arm64/boot/dts/xilinx/zynqmp.dtsi"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"lessThan": "6.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.75", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.16", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F8A1C6F6-2847-4C53-ABFC-8F07D96900D2", "versionEndExcluding": "6.12.75", "versionStartIncluding": "6.9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"arm64: zynqmp: Add an OP-TEE node to the device tree\"\n\nThis reverts commit 06d22ed6b6635b17551f386b50bb5aaff9b75fbe.\n\nOP-TEE logic in U-Boot automatically injects a reserved-memory\nnode along with optee firmware node to kernel device tree.\nThe injection logic is dependent on that there is no manually\ndefined optee node. Having the node in zynqmp.dtsi effectively\nbreaks OP-TEE's insertion of the reserved-memory node, causing\nmemory access violations during runtime."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nRevertir 'arm64: zynqmp: A\u00f1adir un nodo OP-TEE al \u00e1rbol de dispositivos'\n\nEsto revierte el commit 06d22ed6b6635b17551f386b50bb5aaff9b75fbe.\n\nLa l\u00f3gica de OP-TEE en U-Boot inyecta autom\u00e1ticamente un nodo de memoria reservada junto con el nodo de firmware optee al \u00e1rbol de dispositivos del kernel. La l\u00f3gica de inyecci\u00f3n depende de que no haya un nodo optee definido manualmente. Tener el nodo en zynqmp.dtsi rompe efectivamente la inserci\u00f3n del nodo de memoria reservada por parte de OP-TEE, causando violaciones de acceso a memoria durante el tiempo de ejecuci\u00f3n."}], "id": "CVE-2025-71300", "lastModified": "2026-10-14T13:10:00.187", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-05-08T14:16:31.387", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2a833c730d4e8d1cc10953270ce0f3a156145d81"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3983ef126e439900bbf419724a9759863c146660"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c197179990124f991fca220d97fac56779a02c6d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/eece81eeda10eb42c687399fb5aa69977ae15664"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: Revert \"arm64: zynqmp: Add an OP-TEE node to the device tree\"", "id": "2468077", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2468077"}, "csaw": false, "cwe": "CWE-909", "details": ["A flaw was found in the Linux kernel, specifically within the OP-TEE (Open Portable Trusted Execution Environment) integration with U-Boot. The U-Boot's OP-TEE logic automatically injects a reserved-memory node into the kernel device tree. However, a manually defined OP-TEE node in `zynqmp.dtsi` interferes with this process, leading to memory access violations during runtime. This issue can result in system instability or denial of service."], "name": "CVE-2025-71300", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-71300\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-71300\nhttps://lore.kernel.org/linux-cve-announce/2026050824-CVE-2025-71300-fe93@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[06d22ed6b6635b17551f386b50bb5aaff9b75fbe,eece81eeda10eb42c687399fb5aa69977ae15664)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[06d22ed6b6635b17551f386b50bb5aaff9b75fbe,3983ef126e439900bbf419724a9759863c146660)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[06d22ed6b6635b17551f386b50bb5aaff9b75fbe,2a833c730d4e8d1cc10953270ce0f3a156145d81)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[06d22ed6b6635b17551f386b50bb5aaff9b75fbe,c197179990124f991fca220d97fac56779a02c6d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.75,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.16,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.6,6.19.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-08T14:45:05.769473+00:00", "updated": "2026-08-04T08:45:06.026987+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}