CVE-2025-71186: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71186 is a device reference leak vulnerability in the Linux kernel's DMA engine STM32 DMAMUX driver. During route allocation, the driver fails to drop the reference taken when looking up the DMA mux platform device, resulting in a resource leak (CWE-401). The vulnerability affects Linux kernel versions from 4.15 through multiple stable branches, with fixed versions including 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.67, and 6.18.7. It was published on January 31, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In the stm32-dmamux driver, when allocating a DMA route, the code calls a platform device lookup function that increments the device reference count, but never calls the corresponding put_device() to release it. As noted in the fix, holding a reference to a device does not prevent its driver data from becoming unavailable, making the retained reference both a leak and functionally useless. The vulnerability requires local access with low privileges to trigger, as it is exercised through normal DMA route allocation operations on affected STM32 hardware (Red Hat Bugzilla, Red Hat Advisory).

The primary impact is availability degradation through resource exhaustion. As device references accumulate without being released over repeated DMA route allocations, systems may experience gradual memory pressure and instability, particularly in memory-constrained environments or those performing frequent DMA operations. There is no confidentiality or integrity impact; the vulnerability is limited to availability (CVSS A:H, C:N, I:N) (Red Hat Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is approximately 0.018% (0.000180), reflecting very low probability of exploitation in the near term. Exploitation requires local access with low privileges and is limited to systems using STM32 DMA hardware (Red Hat Advisory).

Update the Linux kernel to a patched version that resolves the STM32 DMAMUX device leak. Fixed versions are available across multiple stable branches: 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.67, 6.18.7, and 6.19-rc6. Patches are available in the upstream kernel stable repository. Ubuntu has issued multiple security notices (USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8278-1, USN-8289-1, USN-8296-1, USN-8297-1) addressing this and related kernel vulnerabilities (Red Hat Advisory, Ubuntu USN-8180-1).