CVE-2025-71112

In the Linux kernel, the following vulnerability has been resolved:

net: hns3: add VLAN id validation before using

Currently, the VLAN id may be used without validation when receive a VLAN configuration mailbox from VF. The length of vlan_del_fail_bmap is BITS_TO_LONGS(VLAN_N_VID). It may cause out-of-bounds memory access once the VLAN id is bigger than or equal to VLAN_N_VID.

Therefore, VLAN id needs to be checked to ensure it is within the range of VLAN_N_VID.

The vulnerability is caused by missing validation of VLAN IDs received from a VF, allowing out-of-range values to be used as bitmap indexes and triggering out-of-bounds memory access in the PF driver. This enables a guest-to-host attack scenario in SR-IOV (Single Root I/O Virtualization) environments, where a malicious VF (Virtual Function, i.e. a virtualized PCI device controlled by a guest VM) can crash the host kernel and potentially corrupt memory in the PF (Physical Function, i.e. the real hardware device driver running in the host).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.