CVE-2025-71154
Estado: AnalizadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
Detalles técnicos trazas, registros y código del informe original
In async_set_registers(), when usb_submit_urb() fails, the allocated async_req structure and URB are not freed, causing a memory leak. The completion callback async_set_reg_cb() is responsible for freeing these allocations, but it is only called after the URB is successfully submitted and completes (successfully or with error). If submission fails, the callback never runs and the memory is leaked. Fix this by freeing both the URB and the request structure in the error path when usb_submit_urb() fails.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.13%
- Percentil entre todas las CVEs puntuadas: 2
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-401
Referencias
- https://git.kernel.org/stable/c/12cab1191d9890097171156d06bfa8d31f1e39c8
- https://git.kernel.org/stable/c/151403e903840c9cf06754097b6732c14f26c532
- https://git.kernel.org/stable/c/2f966186b99550e3c665dbfb87b8314e30acea02
- https://git.kernel.org/stable/c/4bd4ea3eb326608ffc296db12c105f92dc2f2190
- https://git.kernel.org/stable/c/6492ad6439ff1a479fc94dc6052df3628faed8b6
- https://git.kernel.org/stable/c/a4e2442d3c48355a84463342f397134f149936d7
- https://git.kernel.org/stable/c/db2244c580540306d60ce783ed340190720cd429
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-71154",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-71154",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-06-10T20:42:06.317102Z"
}
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4d12997a9bb3d217ad4b925ec3074ec89364bf95",
"lessThan": "a4e2442d3c48355a84463342f397134f149936d7",
"versionType": "git"
},
{
"status": "affected",
"version": "4d12997a9bb3d217ad4b925ec3074ec89364bf95",
"lessThan": "2f966186b99550e3c665dbfb87b8314e30acea02",
"versionType": "git"
},
{
"status": "affected",
"version": "4d12997a9bb3d217ad4b925ec3074ec89364bf95",
"lessThan": "db2244c580540306d60ce783ed340190720cd429",
"versionType": "git"
},
{
"status": "affected",
"version": "4d12997a9bb3d217ad4b925ec3074ec89364bf95",
"lessThan": "4bd4ea3eb326608ffc296db12c105f92dc2f2190",
"versionType": "git"
},
{
"status": "affected",
"version": "4d12997a9bb3d217ad4b925ec3074ec89364bf95",
"lessThan": "6492ad6439ff1a479fc94dc6052df3628faed8b6",
"versionType": "git"
},
{
"status": "affected",
"version": "4d12997a9bb3d217ad4b925ec3074ec89364bf95",
"lessThan": "151403e903840c9cf06754097b6732c14f26c532",
"versionType": "git"
},
{
"status": "affected",
"version": "4d12997a9bb3d217ad4b925ec3074ec89364bf95",
"lessThan": "12cab1191d9890097171156d06bfa8d31f1e39c8",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/usb/rtl8150.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.10",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.248",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.198",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.160",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.120",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.64",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.4",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "6.19",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/usb/rtl8150.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-01-23T15:16:06.327",
"references": [
{
"url": "https://git.kernel.org/stable/c/12cab1191d9890097171156d06bfa8d31f1e39c8",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/151403e903840c9cf06754097b6732c14f26c532",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/2f966186b99550e3c665dbfb87b8314e30acea02",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4bd4ea3eb326608ffc296db12c105f92dc2f2190",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/6492ad6439ff1a479fc94dc6052df3628faed8b6",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a4e2442d3c48355a84463342f397134f149936d7",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/db2244c580540306d60ce783ed340190720cd429",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-401"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usb: rtl8150: fix memory leak on usb_submit_urb() failure\n\nIn async_set_registers(), when usb_submit_urb() fails, the allocated\n async_req structure and URB are not freed, causing a memory leak.\n\n The completion callback async_set_reg_cb() is responsible for freeing\n these allocations, but it is only called after the URB is successfully\n submitted and completes (successfully or with error). If submission\n fails, the callback never runs and the memory is leaked.\n\n Fix this by freeing both the URB and the request structure in the error\n path when usb_submit_urb() fails."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: usb: rtl8150: corregir fuga de memoria en caso de fallo de usb_submit_urb()\n\nEn async_set_registers(), cuando usb_submit_urb() falla, la estructura async_req asignada y el URB no se liberan, causando una fuga de memoria.\n\nLa función de devolución de llamada de finalización async_set_reg_cb() es responsable de liberar estas asignaciones, pero solo se llama después de que el URB se envía con éxito y se completa (con éxito o con error). Si el envío falla, la función de devolución de llamada nunca se ejecuta y la memoria se fuga.\n\nSolucione esto liberando tanto el URB como la estructura de solicitud en la ruta de error cuando usb_submit_urb() falla."
}
],
"lastModified": "2026-06-17T10:03:46.330",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF50C87B-4799-493D-B6D4-1222ADF5285D",
"versionEndExcluding": "5.10.248",
"versionStartIncluding": "3.10.1"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "82159CAA-B6BA-43C6-85D8-65BDBC175A7E",
"versionEndExcluding": "5.15.198",
"versionStartIncluding": "5.11"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C10CC03E-16A9-428A-B449-40D3763E15F6",
"versionEndExcluding": "6.1.160",
"versionStartIncluding": "5.16"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "43C3A206-5EEE-417B-AA0F-EF8972E7A9F0",
"versionEndExcluding": "6.6.120",
"versionStartIncluding": "6.2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "32BF4A52-377C-44ED-B5E6-7EA5D896E98B",
"versionEndExcluding": "6.12.64",
"versionStartIncluding": "6.7"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DC988EA0-0E32-457A-BF95-89BEB31A227B",
"versionEndExcluding": "6.18.4",
"versionStartIncluding": "6.13"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:3.10:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "82D28405-E1F2-43CF-AA38-B228805AFFF9"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:3.10:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7B933742-22C3-41D1-9588-C7E7A126DDD3"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:3.10:rc4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DC6F70D0-FB0D-4CCA-B54B-2D50D7E05C79"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:3.10:rc5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7531C844-BA6E-44F3-BCBC-1036C21541C4"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:3.10:rc6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2DD6E1E7-AF5F-46ED-A729-288651810FFF"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:3.10:rc7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7EDF2BC7-2812-4297-9FF3-2CFFE1EE8584"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}