CVE-2025-71191: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71191 is a device reference leak vulnerability in the Linux kernel's at_hdmac DMA engine driver, specifically in the of_dma_xlate() function. The flaw causes a kernel device reference to be taken when looking up the DMA platform device but never released upon successful channel allocation, leading to progressive memory exhaustion. It was published on January 31, 2026, and affects Linux kernel versions from 3.10.1 through multiple stable branches up to 6.18.x and 6.19-rc releases. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium), requiring local access with low privileges (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an improper resource cleanup (CWE-401: Missing Release of Memory after Effective Lifetime) in the at_hdmac DMA engine driver's of_dma_xlate() function. When a DMA channel is successfully allocated, the function calls get_device() to take a reference on the platform device but fails to call the corresponding put_device() when the channel is later released. A prior fix (commit 3832b78b3ec2) addressed the leak only in error paths, leaving the successful allocation path unpatched. Exploitation requires local access with low privileges on a system using Atmel DMA hardware with the at_hdmac driver loaded (Red Hat Bugzilla, Red Hat Advisory).

The primary impact is availability: repeated allocation and release of DMA channels causes kernel device references to accumulate without being freed, progressively exhausting kernel memory. Over time, this can lead to system instability, degraded performance, and ultimately a denial-of-service condition on affected systems. There is no confidentiality or integrity impact; the vulnerability is limited to systems using Atmel DMA hardware with the at_hdmac driver, such as embedded and IoT platforms based on Atmel/Microchip SoCs (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.018% (0.000180), reflecting very low probability of exploitation in the near term. Exploitation requires local access and is limited to hardware platforms using the at_hdmac DMA driver, significantly narrowing the attack surface (Red Hat Advisory).

Patches are available in the upstream Linux kernel stable trees. Affected users should upgrade to the following fixed versions or later: 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.67, 6.18.7, or 6.19-rc6. Ubuntu has issued multiple security notices (USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8278-1/2, USN-8289-1/2, USN-8296-1/2, USN-8297-1, USN-8393-1) addressing this CVE. SUSE has also released patches. For systems unable to patch immediately, monitoring kernel memory usage and scheduling periodic reboots may temporarily mitigate progressive memory depletion (Red Hat Advisory, Red Hat Bugzilla).