BaseFortify

Publication date: 2026-01-23

Last updated on: 2026-02-26

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: ensure worker is torn down When an IRQ worker is running, unplugging the device would cause a crash. The sealevel hardware this driver was written for was not hotpluggable, so I never realized it. This change uses a spinlock to protect a list of workers, which it tears down on disconnect.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-23

Last Modified

2026-02-26

Generated

2026-07-06

AI Q&A

2026-01-23

EPSS Evaluated

2026-07-05

NVD

CVE-2025-71158

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.13 (inc) to 6.18.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability occurs in the Linux kernel's gpio: mpsse driver. When an IRQ worker is running and the device is unplugged, it causes a system crash because the driver was originally written for hardware that was not hotpluggable. The fix involves using a spinlock to protect a list of workers and properly tearing down the worker on device disconnect to prevent the crash.

Impact Analysis

If you unplug a device while an IRQ worker is running, it can cause the system to crash, leading to potential downtime or data loss. This affects system stability and reliability when using the affected hardware and driver.

Mitigation Strategies

To mitigate this vulnerability, update the Linux kernel to a version that includes the fix for the gpio: mpsse driver, which ensures the worker is properly torn down on device disconnect. Avoid hotplugging devices that use this driver until the fix is applied.

Hi! I’m here to help you understand CVE-2025-71158. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70