---
cve: "CVE-2025-71291"
severity: "MEDIUM"
cvss: 5.5
epss: "0.1%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-05-06 12:16:28"
tags: [cve, security, medium]
source: tsecurity.de CVE-Dossier
exported: "2026-11-08T04:13:31+01:00"
---

# CVE-2025-71291

> 5.5 MEDIUM

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

misc: bcm_vk: Fix possible null-pointer dereferences in bcm_vk_read()

In the function bcm_vk_read(), the pointer entry is checked, indicating
that it can be NULL. If entry is NULL and rc is set to -EMSGSIZE, the
following code may cause null-pointer dereferences:

  struct vk_msg_blk tmp_msg = entry->to_h_msg[0];
  set_msg_id(&tmp_msg, entry->usr_msg_id);
  tmp_msg.size = entry->to_h_blks - 1;

To prevent these possible null-pointer dereferences, copy to_h_msg,
usr_msg_id, and to_h_blks from iter into temporary variables, and return
these temporary variables to the application instead of accessing them
through a potentially NULL entry.

## CNA-Record (Kanon, cvelistV5)

- CNA: **Linux**
- State: PUBLISHED
- Stand: 2026-05-11 21:57:21

## CVSS-Vektor

```
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Keine | good |
| I Integrität | Keine | good |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-476** — NULL Pointer Dereference
  The product dereferences a pointer that it expects to be valid but is NULL.

## Patch verfügbar (OSV)

- Kernel ≥ 6.1.165
- Kernel ≥ 6.6.128
- Kernel ≥ 6.12.75
- Kernel ≥ 6.18.16
- Kernel ≥ 6.19.6

## BSI-Hinweise (deutsch)

- [Linux Kernel: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-1405) — _BSI-Einstufung: mittel_
  Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um nicht spezifizierte Angriffe durchzuführen, möglicherweise Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren oder offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

## Referenzen

- <https://git.kernel.org/stable/c/741c5a3a0cd893a4218fc0fc8c18403e54fcfb22>
- <https://git.kernel.org/stable/c/ece3722169ba93734bfd1f06255e8ab7f19fe964>
- <https://git.kernel.org/stable/c/aa97ccc3dc1eba9f4537f0410e9dbb0b05ccf2fb>
- <https://git.kernel.org/stable/c/3842f93e6e29d5cc1dcb9e5bda70587b444bed69>
- <https://git.kernel.org/stable/c/20f2d9dbe5e972516f8f9948d7ae5b95d1ad77bd>
- <https://git.kernel.org/stable/c/ba75ecb97d3f4e95d59002c13afb6519205be6cb>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2025-71291/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_