CVE-2025-71141: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71141 is a denial-of-service vulnerability in the Linux kernel's drm/tilcdc DRM driver caused by improper cleanup during failed probe operations. The drm_kms_helper_poll_fini() and drm_atomic_helper_shutdown() helpers are called unconditionally in tilcdc_fini(), even when device registration has not completed, triggering kernel warnings and potential system instability during probe deferral scenarios. Affected kernel versions include 6.5.12 up to (excluding) 6.6, 6.6.2 up to (excluding) 6.6.120, 6.7.1 up to (excluding) 6.18.4, and 6.19-rc1 through 6.19-rc8. The vulnerability was published on January 14, 2026, with CVSS v3.1 base score of 5.5 (Medium) (Feedly, kernel.org patch).

The root cause is improper resource cleanup logic (classified as NVD-CWE-noinfo / insufficient information, though functionally related to improper error handling) in the tilcdc_fini() function of the Linux kernel's TILCDC DRM driver. When a probe operation fails or is deferred, the cleanup path unconditionally invokes drm_kms_helper_poll_fini() and drm_atomic_helper_shutdown(), which attempt to operate on DRM state that was never fully initialized — specifically calling drm_atomic_helper_crtc_duplicate_state() on an unregistered CRTC. The fix rewrites the failed probe cleanup path using the standard goto error handling pattern, ensuring cleanup functions are only invoked for successfully initialized resources, and removes the now-redundant is_registered flag (Feedly, kernel.org patch). Exploitation requires local access with low privileges and low attack complexity.

Successful exploitation causes denial of service through kernel warnings and potential system instability or crashes on systems using the TILCDC DRM driver (typically embedded/ARM platforms such as Texas Instruments AM335x SoCs). A local attacker with low privileges can trigger probe deferral scenarios that cause the kernel to execute cleanup routines on uninitialized DRM state, resulting in high availability impact with no confidentiality or integrity impact (Feedly). The scope is limited to systems with the tilcdc kernel module loaded or built-in, which narrows the affected population primarily to embedded Linux deployments on TI hardware.

• Logs: Kernel warning messages in dmesg or /var/log/kern.log referencing drm_atomic_helper_crtc_duplicate_state+0x60/0x68 at drivers/gpu/drm/drm_atomic_state_helper.c:175 during system boot or driver load.
• Logs: Call stack traces showing tilcdc_fini → drm_atomic_helper_shutdown → drm_atomic_helper_disable_all → drm_atomic_get_crtc_state → drm_atomic_helper_crtc_duplicate_state in kernel logs.
• Process: Kernel oops or BUG warnings associated with PID 23 (kworker or similar early-boot process) during tilcdc_pdev_probe execution.

Apply the available kernel patches for the respective stable branches: kernel 6.6.120+ (commit 21e52dc7762908c3d499cfb493d1b8281fc1d3ab), kernel 6.18.4+ (commit 71be8825e83c90c1e020feb77b29e6a99629e642), and kernel 6.19-rc1+ (commit a585c7ef9cabda58088916baedc6573e9a5cd2a7) (kernel.org patch). Ubuntu users should apply security notices USN-8277-1, USN-8277-2, USN-8310-1, and USN-8374-1 as applicable (Ubuntu USN-8277-1, Ubuntu USN-8374-1). As a temporary workaround on systems where the tilcdc driver is not required, blacklisting the tilcdc kernel module (echo 'blacklist tilcdc' >> /etc/modprobe.d/blacklist.conf) will prevent the vulnerable code path from being triggered.