SB20260509110 - Improper Initialization in Linux kernel dts xilinx

Description

This security bulletin contains information about 1 vulnerability.

1) Improper Initialization (CVE-ID: CVE-2025-71300)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource initialization in the arm64 zynqmp device tree OP-TEE node handling when booting systems with OP-TEE logic in U-Boot. A local user can trigger the vulnerable configuration to cause a denial of service.

The issue occurs because a manually defined OP-TEE node prevents automatic insertion of the reserved-memory node, leading to memory access violations during runtime.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2a833c730d4e8d1cc10953270ce0f3a156145d81
• https://git.kernel.org/stable/c/3983ef126e439900bbf419724a9759863c146660
• https://git.kernel.org/stable/c/c197179990124f991fca220d97fac56779a02c6d
• https://git.kernel.org/stable/c/eece81eeda10eb42c687399fb5aa69977ae15664