CVE-2025-71145: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71145 is a use-after-free vulnerability in the Linux kernel's isp1301 USB PHY driver caused by a reference counting imbalance in non-Device Tree (non-OF) device configurations. The isp1301_get_client() helper function increments the I2C device reference count only in the OF (Open Firmware/Device Tree) case, leaving non-OF callers that unconditionally decrement the reference count exposed to a use-after-free condition. Affected kernel versions are 5.10.248 through 5.11 (exclusive). It was published on January 23, 2026, with NVD initial analysis completed February 26, 2026. The CVSS v3.1 base score is 7.8 (High) (Red Hat Advisory, Feedly).

The root cause is a reference counting imbalance (classified as NVD-CWE-Other) in the isp1301_get_client() function within drivers/usb/phy/phy-isp1301.c. A prior fix for a device reference leak in a UDC driver introduced an asymmetry: the function increments the I2C client's reference count only when the device is discovered via Device Tree (OF path), but not in the non-OF path. When the caller unconditionally calls put_device() on the returned I2C client, the reference count can drop to zero prematurely, freeing the object while it may still be in use — a classic use-after-free. The vulnerability is inherently racy because nothing prevents the PHY driver from being unbound concurrently while the I2C client is being accessed (Red Hat Advisory, Feedly).

A local attacker with low privileges could trigger the use-after-free condition to cause kernel crashes (denial of service), data corruption, or potentially achieve arbitrary code execution in kernel context. The vulnerability affects confidentiality, integrity, and availability at a high level, as kernel-level code execution could allow full system compromise. The race condition nature of the bug means exploitation timing is non-trivial, but the impact if successfully triggered is severe (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The EPSS score is approximately 0.01% (0.000100), indicating very low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and is complicated by the inherent race condition in triggering the use-after-free (Feedly).

Apply the upstream Linux kernel patches that fix the reference counting imbalance by incrementing the reference count for non-OF devices in isp1301_get_client(). Six stable kernel patch commits address this issue: 03bbdaa4da8c, 43e58abad6c0, 5d3df03f7054, 7501ecfe3e52, 75c5d9bce072, and b4b64fda4d30 (kernel.org patches). Systems running kernel versions 5.10.248 through 5.11 should be prioritized for patching. As an interim measure where patching is not immediately possible, restrict local access to unprivileged users and monitor system logs for kernel crashes or unusual USB PHY driver behavior (Red Hat Advisory, Feedly).