CVE-2025-71158
BaseFortify
Publication date: 2026-01-23
Last updated on: 2026-02-26
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 6.13 (inc) to 6.18.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's gpio: mpsse driver. When an IRQ worker is running and the device is unplugged, it causes a system crash because the driver was originally written for hardware that was not hotpluggable. The fix involves using a spinlock to protect a list of workers and properly tearing down the worker on device disconnect to prevent the crash.
How can this vulnerability impact me? :
If you unplug a device while an IRQ worker is running, it can cause the system to crash, leading to potential downtime or data loss. This affects system stability and reliability when using the affected hardware and driver.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version that includes the fix for the gpio: mpsse driver, which ensures the worker is properly torn down on device disconnect. Avoid hotplugging devices that use this driver until the fix is applied.