CVE-2025-71158: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-71158 is a use-after-free vulnerability in the Linux kernel's GPIO MPSSE driver (gpio: mpsse) that causes a kernel crash when a USB device is unplugged while an IRQ worker thread is still running. The driver was originally written for non-hotpluggable Sealevel hardware and lacked proper worker teardown logic on device disconnection. It affects Linux kernel versions 6.13 through 6.18.5 (fixed in 6.18.6). The vulnerability was published on January 23, 2026, with a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper resource cleanup (CWE classified as insufficient information by NVD) in the gpio-mpsse kernel driver: when a USB device is disconnected, the driver does not wait for or cancel active IRQ worker threads, leading to a use-after-free condition as the worker continues to access freed device memory. The fix introduces a spinlock to protect a list of active workers and ensures all workers are torn down during the disconnect callback. Exploitation requires local access and physical ability to unplug the GPIO MPSSE device while IRQ processing is active. Patches are available as two commits to the Linux kernel stable branches (kernel.org patch 1, kernel.org patch 2).

Successful exploitation results in a kernel crash (panic), causing a denial of service on the affected system. There is no impact on confidentiality or integrity — only availability is affected. The impact is limited to systems with GPIO MPSSE hardware (e.g., Sealevel USB devices) physically connected, and cannot be triggered remotely (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication. The EPSS score is extremely low at 0.000180, reflecting minimal exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires both local privileges and physical access to unplug the GPIO MPSSE device at the right moment (Red Hat Advisory).

Update the Linux kernel to version 6.18.6 or later, which includes the fix via two commits to the stable kernel branches. Systems without GPIO MPSSE hardware (e.g., Sealevel USB devices) are not affected and require no action. As a workaround, restricting physical access to systems with GPIO MPSSE hardware connected reduces exploitation risk. Nessus plugin 296384 can be used to detect vulnerable configurations (Red Hat Bugzilla, kernel.org patch 1).