« Volver al listado

CVE-2025-71199

Estado: AplazadaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver

at91_adc_interrupt can call at91_adc_touch_data_handler function to start the work by schedule_work(&st->touch_st.workq).

If we remove the module which will call at91_adc_remove to make cleanup, it will free indio_dev through iio_device_unregister but quite a bit later. While the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows:

CPU0 CPU1

Fix it by ensuring that the work is canceled before proceeding with the cleanup in at91_adc_remove.

Detalles técnicos trazas, registros y código del informe original
                                     | at91_adc_workq_handler
at91_adc_remove                      |
iio_device_unregister(indio_dev)     |
//free indio_dev a bit later         |
                                     | iio_push_to_buffers(indio_dev)
                                     | //use indio_dev

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-71199",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "23ec2774f1cc168b1f32a2e0ed2709cb473bb94e",
              "lessThan": "4c83dd62595ee7b7c9298a4d19a256b6647e7240",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "23ec2774f1cc168b1f32a2e0ed2709cb473bb94e",
              "lessThan": "fdc8c835c637a3473878d1e7438c77ab8928af63",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "23ec2774f1cc168b1f32a2e0ed2709cb473bb94e",
              "lessThan": "919d176b05776c7ede79c36744c823a07d631617",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "23ec2774f1cc168b1f32a2e0ed2709cb473bb94e",
              "lessThan": "9795fe80976f8c31cafda7d44edfc0f532d1f7c4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "23ec2774f1cc168b1f32a2e0ed2709cb473bb94e",
              "lessThan": "d7b6fc224c7f5d6d8adcb18037138d3cfe2bbdfe",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "23ec2774f1cc168b1f32a2e0ed2709cb473bb94e",
              "lessThan": "d890234a91570542c228a20f132ce74f9fedd904",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "23ec2774f1cc168b1f32a2e0ed2709cb473bb94e",
              "lessThan": "dbdb442218cd9d613adeab31a88ac973f22c4873",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/iio/adc/at91-sama5d2_adc.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.19"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.19",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.249",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.199",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.122",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.68",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.8",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/iio/adc/at91-sama5d2_adc.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-02-04T17:16:11.847",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/4c83dd62595ee7b7c9298a4d19a256b6647e7240",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/919d176b05776c7ede79c36744c823a07d631617",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9795fe80976f8c31cafda7d44edfc0f532d1f7c4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d7b6fc224c7f5d6d8adcb18037138d3cfe2bbdfe",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d890234a91570542c228a20f132ce74f9fedd904",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/dbdb442218cd9d613adeab31a88ac973f22c4873",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fdc8c835c637a3473878d1e7438c77ab8928af63",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver\n\nat91_adc_interrupt can call at91_adc_touch_data_handler function\nto start the work by schedule_work(&st->touch_st.workq).\n\nIf we remove the module which will call at91_adc_remove to\nmake cleanup, it will free indio_dev through iio_device_unregister but\nquite a bit later. While the work mentioned above will be used. The\nsequence of operations that may lead to a UAF bug is as follows:\n\nCPU0                                      CPU1\n\n                                     | at91_adc_workq_handler\nat91_adc_remove                      |\niio_device_unregister(indio_dev)     |\n//free indio_dev a bit later         |\n                                     | iio_push_to_buffers(indio_dev)\n                                     | //use indio_dev\n\nFix it by ensuring that the work is canceled before proceeding with\nthe cleanup in at91_adc_remove."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\niio: adc: at91-sama5d2_adc: Soluciona un potencial uso después de liberación en el controlador sama5d2_adc\n\nat91_adc_interrupt puede llamar a la función at91_adc_touch_data_handler para iniciar el trabajo mediante schedule_work(&st->touch_st.workq).\n\nSi eliminamos el módulo que llamará a at91_adc_remove para realizar la limpieza, liberará indio_dev a través de iio_device_unregister pero bastante más tarde. Mientras que el trabajo mencionado anteriormente será utilizado. La secuencia de operaciones que puede llevar a un error UAF es la siguiente:\n\nCPU0 CPU1\n\n                                     | at91_adc_workq_handler\nat91_adc_remove                      |\niio_device_unregister(indio_dev)     |\n//liberar indio_dev un poco más tarde |\n                                     | iio_push_to_buffers(indio_dev)\n                                     | //usar indio_dev\n\nSe soluciona asegurando que el trabajo sea cancelado antes de proceder con la limpieza en at91_adc_remove."
    }
  ],
  "lastModified": "2026-06-17T10:03:52.323",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}