CVE-2025-71187: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-71187 is a device reference leak vulnerability in the Linux kernel's dmaengine: sh: rz-dmac driver. The flaw causes the driver to fail to release the reference taken when looking up the ICU (Interrupt Controller Unit) device during probe failures, such as probe deferral, leading to unreleased device references accumulating in memory. It affects Linux kernel versions 6.16, 6.16.1 through 6.18.6, and 6.19-rc1 through 6.19-rc5. The vulnerability was published on January 31, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In the rz-dmac DMA engine driver for Renesas RZ SoCs, the probe function acquires a reference to the ICU device via a device lookup but does not release this reference when the probe fails (e.g., due to probe deferral). Over repeated probe failures, these unreleased references accumulate, consuming kernel resources. The attack vector is local, requiring low privileges, and no user interaction is needed (Red Hat Advisory, Red Hat Bugzilla).

Repeated probe failures can cause unreleased device references to accumulate over time, leading to resource exhaustion, system instability, degraded performance, and potential denial of service conditions. The vulnerability impacts only availability — there is no confidentiality or integrity impact. Exploitation requires local access with low-level privileges and is limited in scope to the affected system (Red Hat Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.018% (0.000180), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and low privileges, significantly limiting the attack surface (Red Hat Advisory).

The vulnerability is fixed in Linux kernel version 6.18.7 and later, as well as in 6.19-rc6 and subsequent releases. The specific upstream commits addressing the issue are 926d1666420c227eab50962a8622c1b8444720e8 and 9fb490323997dcb6f749cd2660a17a39854600cd. Systems running kernel versions 6.16, 6.16.1 through 6.18.6, or 6.19-rc1 through 6.19-rc5 should be prioritized for patching. If a full kernel upgrade is not immediately feasible, applying the specific commits directly is an alternative (Red Hat Bugzilla).