Riskcovery

CVE-2025-71231

crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode

State
Published
Severity
Not scored
Published
Feb 18, 2026
Updated
May 11, 2026
Reserved
Feb 18, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: iaa - Fix out-of-bounds index in find_empty_iaa_compression_mode

The local variable 'i' is initialized with -EINVAL, but the for loop immediately overwrites it and -EINVAL is never returned.

If no empty compression mode can be found, the function would return the out-of-bounds index IAA_COMP_MODES_MAX, which would cause an invalid array access in add_iaa_compression_mode().

Fix both issues by returning either a valid index or -EINVAL.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • b190447e0fa3ef7355480d641d078962e03768b4 to before c77b33b58512708bd5603f48465f018c8b748847Affected
  • b190447e0fa3ef7355480d641d078962e03768b4 to before d75207465eed20bc9b0daa4a0927de9568996067Affected
  • b190447e0fa3ef7355480d641d078962e03768b4 to before de16f5bca05cace238d237791ed1b6e9d22dab60Affected
  • b190447e0fa3ef7355480d641d078962e03768b4 to before 48329301969f6d21b2ef35f678e40f72b59eac94Affected
LinuxLinux
  • 6.8Affected
  • before 6.8Not affected
  • 6.12.72 through 6.12.*Not affected
  • 6.18.11 through 6.18.*Not affected
  • 6.19.1 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.