CVE-2025-71093

HIGHNVD 7.17.1
EchelonGraph scoreMEDIUM confidence

“—” beside the score: it is equal to NVD's CVSS score.

Score 7.1 from GitHub Security Advisory (severity: HIGH) published 2026-01-13. NVD baseline CVSS 7.1; sources differ by 0.0.

Triggered by: GitHub Security Advisory CVSS
Sources: EPSS, GitHub Security Advisory, NVD CVSS v3
Trending — 4 sources updated this week

Also known asEUVD-2026-2245 (ENISA EUVD) · GHSA-p43x-q875-62rr (GitHub Security Advisories)Source: ENISA EUVD

7.1EG
EchelonGraph verdictPlan a fixRemediate within your standard update timelines (the SSVC decision on this page).
  • High severity, but no confirmed exploitation yet
CISA-KEV: Not listedEPSS PROB: 0.3%CVSS: 7.1Exploit: None knownExposed services: Not assessed

A fix is available — apply it.

In the Linux kernel, the following vulnerability has been resolved:

e1000: fix OOB in e1000_tbi_should_accept()

In e1000_tbi_should_accept() we read the last byte of the frame via 'data[length - 1]' to evaluate the TBI workaround. If the descriptor- reported length is zero or larger than the actual RX buffer size, this read goes out of bounds and can hit unrelated slab objects. The issue is observed from the NAPI receive path (e1000_clean_rx_irq):

================================================================== BUG: KASAN: slab-out-of-bounds in e1000_tbi_should_accept+0x610/0x790 Read of size 1 at addr ffff888014114e54 by task sshd/363

CPU: 0 PID: 363 Comm: sshd Not tainted 5.18.0-rc1 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x5a/0x74 print_address_description+0x7b/0x440 print_report+0x101/0x200 kasan_report+0xc1/0xf0 e1000_tbi_should_accept+0x610/0x790 e1000_clean_rx_irq+0xa8c/0x1110 e1000_clean+0xde2/0x3c10 __napi_poll+0x98/0x380 net_rx_action+0x491/0xa20 __do_softirq+0x2c9/0x61d do_softirq+0xd1/0x120 __local_bh_enable_ip+0xfe/0x130 ip_finish_output2+0x7d5/0xb00 __ip_queue_xmit+0xe24/0x1ab0 __tcp_transmit_skb+0x1bcb/0x3340 tcp_write_xmit+0x175d/0x6bd0 __tcp_push_pending_frames+0x7b/0x280 tcp_sendmsg_locked+0x2e4f/0x32d0 tcp_sendmsg+0x24/0x40 sock_write_iter+0x322/0x430 vfs_write+0x56c/0xa60 ksys_write+0xd1/0x190 do_syscall_64+0x43/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f511b476b10 Code: 73 01 c3 48 8b 0d 88 d3 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d f9 2b 2c 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 8e 9b 01 00 48 89 04 24 RSP: 002b:00007ffc9211d4e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000004024 RCX: 00007f511b476b10 RDX: 0000000000004024 RSI: 0000559a9385962c RDI: 0000000000000003 RBP: 0000559a9383a400 R08: fffffffffffffff0 R09: 0000000000004f00 R10: 0000000000000070 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc9211d57f R14: 0000559a9347bde7 R15: 0000000000000003 Allocated by task 1: __kasan_krealloc+0x131/0x1c0 krealloc+0x90/0xc0 add_sysfs_param+0xcb/0x8a0 kernel_add_sysfs_param+0x81/0xd4 param_sysfs_builtin+0x138/0x1a6 param_sysfs_init+0x57/0x5b do_one_initcall+0x104/0x250 do_initcall_level+0x102/0x132 do_initcalls+0x46/0x74 kernel_init_freeable+0x28f/0x393 kernel_init+0x14/0x1a0 ret_from_fork+0x22/0x30 The buggy address belongs to the object at ffff888014114000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1620 bytes to the right of 2048-byte region [ffff888014114000, ffff888014114800] The buggy address belongs to the physical page: page:ffffea0000504400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14110 head:ffffea0000504400 order:3 compound_mapcount:0 compound_pincount:0 flags: 0x100000000010200(slab|head|node=0|zone=1) raw: 0100000000010200 0000000000000000 dead000000000001 ffff888013442000 raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected ==================================================================

This happens because the TBI check unconditionally dereferences the last byte without validating the reported length first:

u8 last_byte = *(data + length - 1);

Fix by rejecting the frame early if the length is zero, or if it exceeds adapter->rx_buffer_len. This preserves the TBI workaround semantics for valid frames and prevents touching memory beyond the RX buffer.

CVSS v3
7.1
EG Score
7.1HIGHmedium confidence
EG Risk
32
EG Risk 32/100

EG Risk is EchelonGraph's 0–100 priority score. It fuses impact severity (EG Severity, the CVSS base score, never the KEV-floored or EPSS-lifted EG Score) with real-world exploitation and automatability, under weights EchelonGraph set by hand, so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner.

How it’s computed (value × EchelonGraph’s weight)
Severity71% × 45%
Impact severity (EG Severity): CVSS 7.1 of 10. Never the KEV-floored or EPSS-lifted EG Score.
Exploitation0.3% × 40%
FIRST EPSS: the 30-day exploitation probability when EchelonGraph scored this CVE.
Automatability0% × 15%
CISA's SSVC Automatable value: no (Vulnrichment).
SSVC (CISA's decision table, applied by EchelonGraph): Track at every mission impact level.
Exploitation none (CISA Vulnrichment) · Automatable no (CISA Vulnrichment) · Technical impact partial (CISA Vulnrichment). All three are CISA's SSVC values (Vulnrichment). EchelonGraph applied CISA's decision table to them; CISA publishes SSVC inputs and the table, not a decision for each CVE.
Action: A fix is available. Apply it within your standard update timelines.
EPSS PROB
0.3%
EPSS %ILE
21st
KEV
Not listed

What the EG score is made of (scorer v4.0: the three questions the 0–10 score mixes, published apart · methodology)

The EG score (7.1): severity, escalated by confirmed exploitation. This CVE's 7.1 is its impact severity (EG Severity), not escalated.

EG Severity
7.1 HIGHCVSS-B, impact only: no KEV listing, EPSS or EG-KEV tier raises it.GitHub Security Advisory CVSS
EG Likelihood
0.3% within 30 daysSource: FIRST EPSS (model v2026.06.15, score date 2026-10-27). FIRST's exploitation probability, not an EchelonGraph model.
Confirmed exploitation
None on record (CISA KEV, EG-KEV Tier 1)Reported apart from the likelihood: an observed fact, not a probability.
EG Priority
SSVC Track at medium mission impactTrack at every mission impact level.CISA BOD 26-04: 60 days if the affected system is publicly exposed; Fix on system upgrade if it is not.Each input and its source, and whom BOD 26-04 binds: the SSVC and BOD 26-04 blocks below.

SSVC (CISA's decision table, applied by EchelonGraph)Track at every mission impact level.

A fix is available. Apply it within your standard update timelines.

Exploitation none (CISA Vulnrichment) · Automatable no (CISA Vulnrichment) · Technical impact partial (CISA Vulnrichment). All three are CISA's SSVC values (Vulnrichment). EchelonGraph applied CISA's decision table to them; CISA publishes SSVC inputs and the table, not a decision for each CVE. Mission impact is CISA's Mission & Well-being decision point, and only you can judge it. CISA's table makes it high when Mission Prevalence is Essential — the vulnerable component "directly provides capabilities that constitute at least one MEF for at least one entity" (MEF: mission essential function) — or when Public Well-Being Impact is Irreversible: "multiple fatalities are likely", the cyber-physical system "is likely lost or destroyed", "extreme or serious externalities" are imposed on other parties, or social systems such as elections or the financial grid "are destabilized and potentially collapse". CISA's decision table

BOD 26-04 (CISA's remediation timeline, Table 1)60 days if the affected system is publicly exposed; Fix on system upgrade if it is not.

The score's inputs: In CISA KEV no (CISA's KEV catalog) · Automatable no (CISA Vulnrichment) · Technical impact partial (CISA Vulnrichment). Whether your system is publicly exposed is yours to answer. BOD 26-04 binds US Federal Civilian Executive Branch agencies; for anyone else it is CISA's published timeline, a reference rather than an obligation. The directive · how EchelonGraph applies it

Published

January 13, 2026

Last Modified

October 19, 2026

Advisory Details (7)

Auto-updated Jul 31, 2026
Patch available.
Web page

e1000: fix OOB in e1000_tbi_should_accept() - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/ee7c125fb3e8b04dd46510130b9fc92380e5d578
Web page

e1000: fix OOB in e1000_tbi_should_accept() - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/ad7a2a45e2417ac54089926b520924f8f0d91aea
Web page

e1000: fix OOB in e1000_tbi_should_accept() - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/9c72a5182ed92904d01057f208c390a303f00a0f
Web page

e1000: fix OOB in e1000_tbi_should_accept() - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/4ccfa56f272241e8d8e2c38191fdbb03df489d80
Web page

e1000: fix OOB in e1000_tbi_should_accept() - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/2c4c0c09f9648ba766d399917d420d03e7b3e1f8
Web page

e1000: fix OOB in e1000_tbi_should_accept() - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/278b7cfe0d4da7502c7fd679b15032f014c92892
Web page

e1000: fix OOB in e1000_tbi_should_accept() - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/26c8bebc2f25288c2bcac7bc0a7662279a0e817c

Vendor Advisories for CVE-2025-71093(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Patch Availability(31)

Vendor / EcosystemFix (by version range) / PatchReleasedSource
ubuntulinux-tools-nvidia-tegra-rt-6.8 (6.8.0-1022.22) @ noble2026-10-27ubuntu
ubuntulinux-tools-azure-edge (6.8.0-1059.65~22.04.1) @ jammy2026-10-27ubuntu
ubuntulinux-tools-azure-edge (5.15.0.1110.119~20.04.1) @ focal2026-10-27ubuntu
ubuntulinux-xilinx-zynqmp-tools-5.15.0-1067 (5.15.0-1067.71) @ jammy2026-10-27ubuntu
ubuntulinux-tools-gcp-fips-5.15 (5.15.0.1103.93) @ jammy2026-10-27ubuntu
ubuntulinux-tools-oracle-64k-6.17 (6.17.0-1011.11) @ questing2026-10-27ubuntu
ubuntulinux-tools-intel-iot-realtime-5.15 (5.15.0.1094.98) @ jammy2026-10-27ubuntu
ubuntulinux-tools-gke-5.15 (5.15.0.1099.98) @ jammy2026-10-27ubuntu
ubuntulinux-tools-raspi-6.8 (6.8.0-1052.56) @ noble2026-10-27ubuntu
ubuntulinux-tools-azure-fips-6.8 (6.8.0-1054.60+fips1) @ noble2026-10-27ubuntu
ubuntulinux-tools-azure-lts-24.04 (6.8.0-1054.60) @ noble2026-10-27ubuntu
ubuntulinux-virtual-6.8 (6.8.0-110.110) @ noble2026-10-27ubuntu
ubuntulinux-tools-nvidia-64k-6.8 (6.8.0-1051.54) @ noble2026-10-27ubuntu
ubuntulinux-virtual-hwe-24.04-edge (6.17.0-22.22) @ questing2026-10-27ubuntu
ubuntulinux-tools-raspi-nolpae (5.15.0.1097.95) @ jammy2026-10-27ubuntu
ubuntulinux-tools-azure-lts-22.04 (5.15.0.1109.107) @ jammy2026-10-27ubuntu
ubuntulinux-tools-gcp-fips-6.8 (6.8.0-1054.57+fips1) @ noble2026-10-27ubuntu
ubuntulinux-tools-azure-fips-5.15 (5.15.0.1109.94) @ jammy2026-10-27ubuntu
ubuntulinux-tools-realtime-5.15 (5.15.0.1102.106) @ jammy2026-10-27ubuntu
ubuntulinux-tools-nvidia-tegra-igx-rt-5.15 (5.15.0.1044.46) @ jammy2026-10-27ubuntu
ubuntulinux-tools-realtime-hwe-24.04-edge (6.17.0-1010.11~24.04.1) @ noble2026-10-27ubuntu
ubuntulinux-tools-gcp-64k-6.17 (6.17.0-1012.12) @ questing2026-10-27ubuntu
ubuntulinux-tools-realtime-6.8.1 (6.8.1-1047.48) @ noble2026-10-27ubuntu
ubuntulinux-tools-raspi-realtime-6.8 (6.8.0-2042.43) @ noble2026-10-27ubuntu
ubuntulinux-tools-azure-6.17 (6.17.0-1013.13) @ questing2026-10-27ubuntu
ubuntulinux-tools-oracle-lts-24.04 (6.8.0-1049.50) @ noble2026-10-27ubuntu
ubuntulinux-tools-nvidia-lowlatency-64k-6.8 (6.8.0-1051.54.1) @ noble2026-10-27ubuntu
ubuntulinux-tools-gcp-edge (6.8.0-1054.57~22.04.1) @ jammy2026-10-27ubuntu
ubuntulinux-tools-raspi-6.17 (6.17.0-1014.14) @ questing2026-10-27ubuntu
ubuntulinux-xilinx-zynqmp (6.8.0.1029.30) @ noble2026-10-27ubuntu
linuxKernel @ 5.10.248 (fixes >=3.18.0)—osv

Patches are aggregated from vendor advisories (Red Hat, Microsoft, Cisco, GitHub) and package ecosystems (OSV, GHSA). Multiple rows for the same upstream release have been deduplicated.

Affected Packages

(5 across 4 ecosystems)
Debian:11(2)
PackageVulnerable rangeFix by version rangeDependents
linux5.10.103-1 ... 5.10.92-2 (48 versions)
  • every version up to 5.10.249-1: fixed in 5.10.249-1
—
linux-6.16.1.106-3~deb11u1 ... 6.1.159-1~deb11u1 (14 versions)
  • every version up to 6.1.162-1~deb11u1: fixed in 6.1.162-1~deb11u1
—
Debian:12(1)
PackageVulnerable rangeFix by version rangeDependents
linux6.1.106-1 ... 6.1.99-1 (46 versions)
  • every version up to 6.1.162-1: fixed in 6.1.162-1
—
Debian:13(1)
PackageVulnerable rangeFix by version rangeDependents
linux6.12.38-1 ... 6.12.69-1~bpo12+1 (10 versions)
  • every version up to 6.12.69-1: fixed in 6.12.69-1
—
Debian:14(1)
PackageVulnerable rangeFix by version rangeDependents
linux6.12.100-1 ... 6.18~rc7-1~exp1 (95 versions)
  • every version up to 6.18.5-1: fixed in 6.18.5-1
—

Weakness Classification(1)

MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.

Additional Vendor Advisories

(24)

Vendors that published advisories for this CVE beyond the curated set above. Broader coverage but minimal per-row detail — click through for the original advisory.

Data Freshness Timeline

(refreshed 10× in last 7d / 47× in last 30d)

Each row is a time one of our pipelines fetched, updated or re-scored this CVE. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. An arrow marks a change the record states ("CVSS v3 → 9.1"); EPSS and GHSA rows show the values recorded at that time, not what changed (EPSS values are rounded; hover one for the exact figures). Most recent first.

Showing the most recent 99 of 214 refreshes on record for this CVE.

A repeat, a row identical to one the same pipeline wrote less than 10 seconds earlier, is not a separate refresh and is not counted. 1 repeat row among the latest 100 is merged into the row it repeats. The 115 oldest rows on record are not shown and were not checked, so the counts can still include repeats.

  1. 2026-11-01 16:33 UTCEPSS rescoreEPSS 0.3% · 21st percentile
  2. 2026-10-31 16:31 UTCEPSS rescoreEPSS 0.3% · 21st percentile
  3. 2026-10-30 16:33 UTCEPSS rescoreEPSS 0.3% · 21st percentile
  4. 2026-10-29 16:32 UTCEPSS rescoreEPSS 0.3% · 21st percentile
  5. 2026-10-28 16:30 UTCEPSS rescoreEPSS 0.3% · 21st percentile
  6. 2026-10-27 20:12 UTCEG score recompute
  7. 2026-10-27 20:12 UTCVendor advisory
  8. 2026-10-27 20:11 UTCGHSA enrichmentGHSA-p43x-q875-62rr · GitHub severity HIGH · GitHub CVSS 7.1
  9. 2026-10-27 16:30 UTCEPSS rescoreEPSS 0.3% · 21st percentile
  10. 2026-10-26 16:30 UTCEPSS rescoreEPSS 0.3% · 21st percentile
  11. 2026-10-25 16:31 UTCEPSS rescoreEPSS 0.3% · 21st percentile
  12. 2026-10-25 16:02 UTCEG score recompute
  13. 2026-10-24 16:31 UTCEPSS rescoreEPSS 0.3% · 20th percentile
  14. 2026-10-23 16:31 UTCEPSS rescoreEPSS 0.3% · 20th percentile
  15. 2026-10-22 16:33 UTCEPSS rescoreEPSS 0.3% · 20th percentile
  16. 2026-10-21 16:31 UTCEPSS rescoreEPSS 0.3% · 20th percentile
  17. 2026-10-20 16:31 UTCEPSS rescoreEPSS 0.3% · 20th percentile
  18. 2026-10-19 19:33 UTCVendor advisory
  19. 2026-10-19 19:32 UTCGHSA enrichmentGHSA-p43x-q875-62rr · GitHub severity HIGH · GitHub CVSS 7.1
  20. 2026-10-19 18:30 UTCEG score recompute
  21. 2026-10-19 18:30 UTCVendor advisory
  22. 2026-10-19 18:29 UTCGHSA enrichmentGHSA-p43x-q875-62rr · GitHub severity HIGH · GitHub CVSS 7.1
  23. 2026-10-19 16:31 UTCEPSS rescoreEPSS 0.3% · 20th percentile
  24. 2026-10-18 05:16 UTCEG score recompute
  25. 2026-10-17 21:52 UTCEG score recompute
Show 74 more
  1. 2026-10-17 21:52 UTCVendor advisory
  2. 2026-10-17 21:52 UTCGHSA enrichmentGHSA-p43x-q875-62rr · GitHub severity HIGH · GitHub CVSS 7.1
  3. 2026-10-17 16:33 UTCEPSS rescoreEPSS 0.3% · 20th percentile
  4. 2026-10-16 16:39 UTCEPSS rescoreEPSS 0.3% · 20th percentile
  5. 2026-10-15 16:31 UTCEPSS rescoreEPSS 0.3% · 20th percentile
  6. 2026-10-14 16:31 UTCEPSS rescoreEPSS 0.3% · 20th percentile
  7. 2026-10-13 16:33 UTCEPSS rescoreEPSS 0.3% · 20th percentile
  8. 2026-10-12 16:45 UTCEG score recompute
  9. 2026-10-12 16:33 UTCEPSS rescoreEPSS 0.3% · 20th percentile
  10. 2026-10-11 20:20 UTCEG score recompute
  11. 2026-10-11 18:32 UTCEG score recompute
  12. 2026-10-11 15:07 UTCEG score recompute
  13. 2026-10-11 13:47 UTCEPSS rescoreEPSS 0.3% · 20th percentile
  14. 2026-10-10 19:59 UTCEPSS rescoreEPSS 0.3% · 20th percentile
  15. 2026-10-09 20:06 UTCEPSS rescoreEPSS 0.3% · 20th percentile
  16. 2026-10-08 21:58 UTCOSV refresh
  17. 2026-10-08 17:11 UTCEPSS rescoreEPSS 0.3% · 19th percentile
  18. 2026-10-07 23:47 UTCEPSS rescoreEPSS 0.3% · 19th percentile
  19. 2026-10-06 15:17 UTCEPSS rescoreEPSS 0.3% · 19th percentile
  20. 2026-10-05 17:42 UTCEPSS rescoreEPSS 0.3% · 19th percentile
  21. 2026-10-04 23:21 UTCEPSS rescoreEPSS 0.3% · 19th percentile
  22. 2026-10-03 14:25 UTCEPSS rescoreEPSS 0.3% · 19th percentile
  23. 2026-10-01 19:49 UTCEPSS rescoreEPSS 0.3% · 19th percentile
  24. 2026-09-30 15:02 UTCEPSS rescoreEPSS 0.3% · 19th percentile
  25. 2026-09-29 15:20 UTCEPSS rescoreEPSS 0.3% · 19th percentile
  26. 2026-09-28 13:50 UTCEPSS rescoreEPSS 0.3% · 19th percentile
  27. 2026-09-26 15:58 UTCEPSS rescoreEPSS 0.3% · 19th percentile
  28. 2026-09-24 14:02 UTCEPSS rescoreEPSS 0.3% · 18th percentile
  29. 2026-09-23 13:47 UTCEPSS rescoreEPSS 0.3% · 21st percentile
  30. 2026-09-20 20:15 UTCEPSS rescoreEPSS 0.3% · 21st percentile
  31. 2026-09-19 04:36 UTCOSV refresh
  32. 2026-09-18 19:27 UTCEPSS rescoreEPSS 0.3% · 21st percentile
  33. 2026-09-17 19:30 UTCEPSS rescoreEPSS 0.3% · 21st percentile
  34. 2026-09-16 14:07 UTCEPSS rescoreEPSS 0.3% · 21st percentile
  35. 2026-09-16 05:14 UTCEPSS rescoreEPSS 0.3% · 21st percentile
  36. 2026-09-15 03:10 UTCEPSS rescoreEPSS 0.3% · 21st percentile
  37. 2026-09-13 16:46 UTCEPSS rescoreEPSS 0.3% · 21st percentile
  38. 2026-09-12 15:00 UTCEPSS rescoreEPSS 0.3% · 21st percentile
  39. 2026-09-11 14:52 UTCEPSS rescoreEPSS 0.3% · 21st percentile
  40. 2026-09-11 09:36 UTCEPSS rescoreEPSS 0.3% · 21st percentile
  41. 2026-09-10 09:34 UTCEPSS rescoreEPSS 0.3% · 17th percentile
  42. 2026-09-08 22:00 UTCEPSS rescoreEPSS 0.3% · 17th percentile
  43. 2026-09-07 16:00 UTCEPSS rescoreEPSS 0.3% · 17th percentile
  44. 2026-09-06 13:47 UTCEPSS rescoreEPSS 0.3% · 17th percentile
  45. 2026-09-04 05:06 UTCEPSS rescoreEPSS 0.3% · 17th percentile
  46. 2026-09-02 14:11 UTCEPSS rescoreEPSS 0.3% · 17th percentile
  47. 2026-09-01 13:53 UTCEPSS rescoreEPSS 0.3% · 17th percentile
  48. 2026-08-31 08:25 UTCOSV refresh
  49. 2026-08-30 01:21 UTCEPSS rescoreEPSS 0.3% · 16th percentile
  50. 2026-08-28 21:40 UTCEPSS rescoreEPSS 0.3% · 16th percentile
  51. 2026-08-27 14:24 UTCEPSS rescoreEPSS 0.3% · 16th percentile
  52. 2026-08-26 14:45 UTCEPSS rescoreEPSS 0.3% · 16th percentile
  53. 2026-08-25 13:48 UTCEPSS rescoreEPSS 0.3% · 16th percentile
  54. 2026-08-24 14:16 UTCEPSS rescoreEPSS 0.3% · 16th percentile
  55. 2026-08-23 00:18 UTCEPSS rescoreEPSS 0.3% · 17th percentile
  56. 2026-08-21 23:48 UTCEPSS rescoreEPSS 0.3% · 17th percentile
  57. 2026-08-20 22:55 UTCEPSS rescoreEPSS 0.3% · 17th percentile
  58. 2026-08-19 17:03 UTCEPSS rescoreEPSS 0.3% · 17th percentile
  59. 2026-08-18 13:48 UTCEPSS rescoreEPSS 0.3% · 17th percentile
  60. 2026-08-17 13:46 UTCEPSS rescoreEPSS 0.3% · 17th percentile
  61. 2026-08-16 14:55 UTCEPSS rescoreEPSS 0.3% · 17th percentile
  62. 2026-08-16 02:14 UTCEPSS rescoreEPSS 0.3% · 17th percentile
  63. 2026-08-15 01:30 UTCEPSS rescoreEPSS 0.3% · 17th percentile
  64. 2026-08-14 14:40 UTCEG score recompute
  65. 2026-08-14 14:40 UTCVendor advisory
  66. 2026-08-14 14:40 UTCGHSA enrichmentGHSA-p43x-q875-62rr · GitHub severity HIGH · GitHub CVSS 7.1
  67. 2026-08-13 22:00 UTCEPSS rescoreEPSS 0.3% · 17th percentile
  68. 2026-08-12 13:50 UTCEPSS rescoreEPSS 0.3% · 17th percentile
  69. 2026-08-11 13:42 UTCEPSS rescoreEPSS 0.2% · 15th percentile
  70. 2026-08-10 23:59 UTCEPSS rescoreEPSS 0.2% · 15th percentile
  71. 2026-08-09 20:11 UTCEG score recompute
  72. 2026-08-09 20:11 UTCVendor advisory
  73. 2026-08-09 20:11 UTCGHSA enrichmentGHSA-p43x-q875-62rr · GitHub severity HIGH · GitHub CVSS 7.1
  74. 2026-08-09 13:46 UTCEPSS rescoreEPSS 0.2% · 15th percentile

Related CVEs(same vendor + same CWE)

Frequently asked(5)

What is CVE-2025-71093?
CVE-2025-71093 is a high-severity vulnerability; its CVE record was published on January 13, 2026. In the Linux kernel, the following vulnerability has been resolved: e1000: fix OOB in e1000_tbi_should_accept() In e1000_tbi_should_accept() we read the last byte of the frame via 'data[length - 1]' to evaluate the TBI workaround. If the descriptor- reported length is zero or larger than the actual…
When was the CVE record for CVE-2025-71093 published?
The CVE record for CVE-2025-71093 was published on January 13, 2026. That is the record's publication date; the vulnerability itself may have been made public earlier. EchelonGraph's copy of the record carries a last-modified date of October 19, 2026; the record at its source may have been updated since.
Is CVE-2025-71093 actively exploited?
CVE-2025-71093 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0.3% probability of exploitation in the next 30 days (21st percentile of EPSS-scored CVEs).
What is the CVSS score of CVE-2025-71093?
CVE-2025-71093 has a CVSS v3 base score of 7.1 (NVD).
How do I remediate CVE-2025-71093?
A fix for CVE-2025-71093 is available: update to the fixed version the vendor names in its advisory. The vendor advisories EchelonGraph has for CVE-2025-71093 are linked in the Vendor Advisories panel on this page.

Dependency Blast Radius

See which npm, PyPI, Go, and Maven packages are affected by CVE-2025-71093

Explore →

Is Your Infrastructure Affected by CVE-2025-71093?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Book a Demo →Browse All CVEs