CVE-2025-71081: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71081 is a resource leak vulnerability in the Linux kernel's ASoC STM32 SAI (Serial Audio Interface) driver that can lead to a potential use-after-free condition. The flaw exists because the OF (Open Firmware) node reference acquired during platform device probing is only released when the set_sync() callback fails during DAI probe, but not on platform probe failures (e.g., probe deferral) or driver unbind. Affected Linux kernel versions span from 4.15 through multiple stable branches up to 6.19-rc8, with fixed versions at 5.15.198, 6.1.160, 6.6.120, 6.12.64, and 6.18.4. It was published on January 13, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime): the STM32 SAI driver calls of_node_get() on the sync provider OF node during platform probe but only calls the corresponding of_node_put() in the error path of the set_sync() DAI callback, leaving the reference unreleased on other failure paths or during normal driver unbind. This creates a memory/reference leak and, if the DAI is reprobed without first rebinding the platform driver, the stale OF node reference can be accessed after the node has been freed, constituting a use-after-free condition. The attack vector is local (AV:L), requires low privileges (PR:L), and no user interaction, making it exploitable by any local user who can trigger driver bind/unbind or probe deferral on a system with the STM32 SAI audio driver loaded (Red Hat CVE).

Successful exploitation primarily affects system availability: a local attacker with low privileges could trigger kernel memory exhaustion or a use-after-free condition, potentially causing kernel panics, system instability, or denial of service. There is no confidentiality or integrity impact identified (C:N/I:N/A:H). The vulnerability is most relevant to embedded systems, IoT devices, and platforms utilizing STM32 audio interfaces, such as those running STM32-based SoCs (Feedly).

Upgrade affected Linux kernel installations to the patched stable versions: 5.15.198, 6.1.160, 6.6.120, 6.12.64, or 6.18.4 (or later). Upstream fixes are available via the following kernel.org commits: 23261f0de094, 3752afcc6d80, 4054a3597d04, 7daa50a2157e, acda653169e1, and bae74771fc5d (kernel.org patch). For systems that cannot be immediately patched, restrict local user access and monitor for unexpected driver bind/unbind operations on STM32 SAI audio devices. Ubuntu security notices USN-8177-1, USN-8177-2, USN-8183-1, USN-8183-2, USN-8245-1, and USN-8257-1 address this issue for Ubuntu users (Ubuntu USN-8177-1).

Red Hat has acknowledged the vulnerability and published a CVE advisory page (Red Hat CVE). Ubuntu has issued multiple security notices (USN-8177-1/2, USN-8183-1/2, USN-8245-1, USN-8257-1) addressing this flaw in their kernel packages (Ubuntu USN-8177-1). Dell has also referenced this CVE in a security update for Dell SmartFabric Manager. No notable independent researcher commentary or significant social media discussion has been observed for this vulnerability.