CVE-2025-71162: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71162 is a use-after-free (UAF) vulnerability in the Linux kernel's Tegra ADMA (Audio DMA) driver that allows a local attacker with low privileges to trigger kernel crashes and system instability. The flaw was disclosed on January 25, 2026, and affects Linux kernel versions from 4.7 through multiple stable branches up to 6.19-rc5. Specifically, affected ranges include 4.7–5.10.248, 5.11–5.15.198, 5.16–6.1.161, 6.2–6.6.121, 6.7–6.12.66, 6.13–6.18.6, and 6.19-rc1 through rc5. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-416 (Use After Free) and stems from a race condition in the tegra_adma_terminate_all() function within the Tegra ADMA driver. The race follows three steps: (1) a DMA transfer completes and triggers an interrupt that schedules the vchan_complete tasklet; (2) audio playback stops and tegra_adma_terminate_all() frees the DMA buffer via kfree(); (3) the previously scheduled tasklet executes and calls vchan_complete(), which attempts to read the already-freed memory. Because tasklets can execute at any point after being scheduled, there is no guarantee the buffer remains valid. The crash is confirmed by KASAN (Kernel Address Sanitizer) logs showing a use-after-free read of size 8 at vchan_complete+0x124/0x3b0 (Red Hat Bugzilla).

Successful exploitation causes kernel panics and denial of service on systems using Tegra ADMA hardware for audio DMA operations, such as NVIDIA Tegra-based embedded and mobile platforms. The vulnerability can be triggered during normal audio playback interruption, stream termination, or XRUN (buffer overrun/underrun) error recovery scenarios. While the primary impact is availability (system crash), the CVSS score also reflects high confidentiality and integrity impact due to the nature of kernel-level memory corruption, which could theoretically be leveraged for further exploitation (Red Hat Advisory, Red Hat Bugzilla).

• Logs: Kernel log entries containing BUG: KASAN: use-after-free in vchan_complete or similar KASAN reports; stack traces referencing vchan_complete, tasklet_action, tegra_adma_terminate_all, or __do_softirq in /var/log/kern.log or dmesg output.
• System Behavior: Unexpected kernel panics or system reboots on Tegra-based systems during audio playback termination or XRUN conditions; audio subsystem instability correlated with DMA driver errors.

The Linux kernel community has released fixes across all affected stable branches. Administrators should update to the following patched versions or later: 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.67, or 6.18.7. The fix introduces vchan_terminate_vdesc() in tegra_adma_stop() to mark descriptors as terminated rather than immediately freeing them, and adds a tegra_adma_synchronize() callback that calls vchan_synchronize() to kill pending tasklets and safely free terminated descriptors. As a temporary workaround on unpatched systems, minimizing audio stream start/stop cycles on affected Tegra hardware can reduce the likelihood of triggering the race condition. Red Hat and Ubuntu have issued security advisories (USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8278-1, USN-8289-1, USN-8296-1, USN-8297-1, and others) for their respective kernel packages (Red Hat Advisory, Ubuntu USN-8180-1).

The vulnerability received standard coverage from Linux distribution security teams, with Red Hat, Ubuntu, and SUSE all issuing advisories and kernel updates. Ubuntu published multiple update notices (USN-8180 series and others) addressing this and related kernel issues. No notable independent researcher commentary or significant social media discussion beyond automated CVE tracking feeds has been observed (Ubuntu USN-8180-1, Red Hat Advisory).