CVE-2025-71188: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71188 is a device reference leak vulnerability in the Linux kernel's dmaengine: lpc18xx-dmamux driver. During route allocation, a reference taken when looking up the DMA mux platform device is not properly released, causing a kernel resource leak. The vulnerability affects Linux kernel versions from 4.3 through multiple stable branches, with fixed versions including 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.67, 6.18.7, and 6.19-rc6. It was published on January 31, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In the lpc18xx_dmamux_reserve_chan() route allocation path, the kernel calls of_find_device_by_node() or an equivalent platform device lookup that increments the device reference count, but the corresponding put_device() call is never made, leaving the reference dangling. The fix ensures the reference is dropped immediately after the lookup, since holding a device reference does not prevent its driver data from being freed and thus provides no meaningful protection. No public proof-of-concept exploit code is known for this vulnerability (Red Hat Bugzilla, Red Hat Advisory).

Successful triggering of this vulnerability results in a device reference count leak within the kernel, causing kernel resources to accumulate over time with each route allocation operation. Repeated allocations can lead to memory exhaustion and degradation of system stability or availability, particularly on systems that frequently allocate DMA mux routes. There is no confidentiality or integrity impact; the sole consequence is a potential denial-of-service condition on affected systems using the LPC18xx DMA mux driver (Red Hat Advisory).

Update the Linux kernel to a patched version: 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.67, 6.18.7, or 6.19-rc6 (or later), depending on the branch in use. Patch commits are available in the upstream stable kernel repository. Distribution-specific updates have been issued by Ubuntu (USN-8162-1, USN-8180-x series, USN-8186-1, USN-8188-1, USN-8275-1, USN-8278-x, USN-8289-x, USN-8296-x, USN-8297-1, USN-8393-1) and SUSE. Administrators should apply kernel updates from their distribution vendor promptly, particularly on systems using NXP LPC18xx/LPC43xx SoCs with the affected DMA mux driver (Red Hat Advisory, Ubuntu USN-8180).