BaseFortify

Publication date: 2026-01-31

Last updated on: 2026-06-02

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: dmaengine: lpc18xx-dmamux: fix device leak on route allocation Make sure to drop the reference taken when looking up the DMA mux platform device during route allocation. Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-31

Last Modified

2026-06-02

Generated

2026-07-06

AI Q&A

2026-02-01

EPSS Evaluated

2026-07-05

NVD

CVE-2025-71188

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	4.3
linux	linux_kernel	From 6.13 (inc) to 6.18.7 (exc)
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	From 5.11 (inc) to 5.15.199 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.162 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.122 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.67 (exc)
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	6.19
linux	linux_kernel	From 4.3.1 (inc) to 5.10.249 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Mitigation Strategies

Apply the updated Linux kernel patch that fixes the dmaengine lpc18xx-dmamux device leak on route allocation by ensuring the reference to the DMA mux platform device is properly dropped during route allocation.

Executive Summary

This vulnerability in the Linux kernel's dmaengine component, specifically in the lpc18xx-dmamux driver, involves a device reference leak during route allocation. The issue is that a reference to the DMA mux platform device was being held unnecessarily, which does not prevent the device's driver data from being removed. The fix ensures that this reference is properly dropped during route allocation to prevent the device leak.

Impact Analysis

The vulnerability can lead to a device reference leak in the Linux kernel, which may cause resource management issues such as memory leaks or instability in systems using the affected dmaengine driver. This could potentially degrade system performance or reliability.

Hi! I’m here to help you understand CVE-2025-71188. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70