CVE-2025-71154: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71154 is a memory leak vulnerability in the Linux kernel's RTL8150 USB network driver (net/usb/rtl8150). In the async_set_registers() function, when usb_submit_urb() fails, the allocated async_req structure and URB are not freed because the completion callback async_set_reg_cb() — which handles cleanup — is never invoked on submission failure. The vulnerability was published on January 23, 2026, and affects Linux kernel versions from 3.10 through multiple stable branches up to 6.18.3. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In async_set_registers(), memory for an async_req structure and a URB is allocated before calling usb_submit_urb(). The design relies on the completion callback async_set_reg_cb() to free these allocations after the URB completes; however, if usb_submit_urb() returns an error, the callback is never scheduled and the allocated memory is permanently leaked. The fix adds explicit kfree() and usb_free_urb() calls in the error path of async_set_registers() to handle this case. Exploitation requires local access with low privileges and is limited to systems using the RTL8150 USB-to-Ethernet adapter driver (Red Hat Advisory, kernel.org patches).

Repeated triggering of the failure condition in usb_submit_urb() progressively exhausts kernel memory, leading to degraded system performance, increased latency, and potential system instability or denial of service. There is no confidentiality or integrity impact — only availability is affected. The scope is limited to the local system; lateral movement or data exfiltration are not applicable to this vulnerability (Red Hat Advisory).

Update the Linux kernel to a patched stable version: 5.10.248 or later, 5.15.198 or later, 6.1.160 or later, 6.6.120 or later, 6.12.64 or later, or 6.18.4 or later. Seven upstream kernel patches have been applied across stable branches. As a temporary workaround on systems where the RTL8150 driver is not needed, the rtl8150 kernel module can be blacklisted to prevent loading. Prioritize patching on systems with local user access and those using RTL8150 USB network adapters (Red Hat Advisory, kernel.org patches).