CVE-2025-71300

In the Linux kernel, the following vulnerability has been resolved: Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" This reverts commit 06d22ed6b6635b17551f386b50bb5aaff9b75fbe. OP-TEE logic in U-Boot automatically injects a reserved-memory node along with optee firmware node to kernel device tree. The injection logic is dependent on that there is no manually defined optee node. Having the node in zynqmp.dtsi effectively breaks OP-TEE's insertion of the reserved-memory node, causing memory access violations during runtime.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/2a833c730d4e8d1cc10953270ce0f3a156145d81	Patch
https://git.kernel.org/stable/c/3983ef126e439900bbf419724a9759863c146660	Patch
https://git.kernel.org/stable/c/c197179990124f991fca220d97fac56779a02c6d	Patch
https://git.kernel.org/stable/c/eece81eeda10eb42c687399fb5aa69977ae15664	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

14 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: Revertir 'arm64: zynqmp: Añadir un nodo OP-TEE al árbol de dispositivos' Esto revierte el commit 06d22ed6b6635b17551f386b50bb5aaff9b75fbe. La lógica de OP-TEE en U-Boot inyecta automáticamente un nodo de memoria reservada junto con el nodo de firmware optee al árbol de dispositivos del kernel. La lógica de inyección depende de que no haya un nodo optee definido manualmente. Tener el nodo en zynqmp.dtsi rompe efectivamente la inserción del nodo de memoria reservada por parte de OP-TEE, causando violaciones de acceso a memoria durante el tiempo de ejecución.

Information

Published : 2026-05-08 14:16

Updated : 2026-10-14 13:10

NVD link : CVE-2025-71300

Mitre link : CVE-2025-71300

CVE.ORG link : CVE-2025-71300

JSON object : View

Products Affected

linux

linux_kernel

CWE

NVD-CWE-noinfo

{"id": "CVE-2025-71300", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "06d22ed6b6635b17551f386b50bb5aaff9b75fbe", "lessThan": "eece81eeda10eb42c687399fb5aa69977ae15664", "versionType": "git"}, {"status": "affected", "version": "06d22ed6b6635b17551f386b50bb5aaff9b75fbe", "lessThan": "3983ef126e439900bbf419724a9759863c146660", "versionType": "git"}, {"status": "affected", "version": "06d22ed6b6635b17551f386b50bb5aaff9b75fbe", "lessThan": "2a833c730d4e8d1cc10953270ce0f3a156145d81", "versionType": "git"}, {"status": "affected", "version": "06d22ed6b6635b17551f386b50bb5aaff9b75fbe", "lessThan": "c197179990124f991fca220d97fac56779a02c6d", "versionType": "git"}], "programFiles": ["arch/arm64/boot/dts/xilinx/zynqmp.dtsi"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.9"}, {"status": "unaffected", "version": "0", "lessThan": "6.9", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.75", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.16", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.6", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["arch/arm64/boot/dts/xilinx/zynqmp.dtsi"], "defaultStatus": "affected"}]}], "published": "2026-05-08T14:16:31.387", "references": [{"url": "https://git.kernel.org/stable/c/2a833c730d4e8d1cc10953270ce0f3a156145d81", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/3983ef126e439900bbf419724a9759863c146660", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c197179990124f991fca220d97fac56779a02c6d", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/eece81eeda10eb42c687399fb5aa69977ae15664", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"arm64: zynqmp: Add an OP-TEE node to the device tree\"\n\nThis reverts commit 06d22ed6b6635b17551f386b50bb5aaff9b75fbe.\n\nOP-TEE logic in U-Boot automatically injects a reserved-memory\nnode along with optee firmware node to kernel device tree.\nThe injection logic is dependent on that there is no manually\ndefined optee node. Having the node in zynqmp.dtsi effectively\nbreaks OP-TEE's insertion of the reserved-memory node, causing\nmemory access violations during runtime."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nRevertir 'arm64: zynqmp: A\u00f1adir un nodo OP-TEE al \u00e1rbol de dispositivos'\n\nEsto revierte el commit 06d22ed6b6635b17551f386b50bb5aaff9b75fbe.\n\nLa l\u00f3gica de OP-TEE en U-Boot inyecta autom\u00e1ticamente un nodo de memoria reservada junto con el nodo de firmware optee al \u00e1rbol de dispositivos del kernel. La l\u00f3gica de inyecci\u00f3n depende de que no haya un nodo optee definido manualmente. Tener el nodo en zynqmp.dtsi rompe efectivamente la inserci\u00f3n del nodo de memoria reservada por parte de OP-TEE, causando violaciones de acceso a memoria durante el tiempo de ejecuci\u00f3n."}], "lastModified": "2026-10-14T13:10:00.187", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F8A1C6F6-2847-4C53-ABFC-8F07D96900D2", "versionEndExcluding": "6.12.75", "versionStartIncluding": "6.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}