CVE-2025-71199: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-71199 is a use-after-free (UAF) vulnerability in the Linux kernel's IIO ADC driver for the Microchip AT91 SAMA5D2 SoC (at91-sama5d2_adc). The flaw arises from a race condition during module removal: the interrupt handler can schedule a work item (at91_adc_touch_data_handler) that accesses indio_dev after it has been freed by at91_adc_remove via iio_device_unregister. The vulnerability was published on February 4, 2026, and affects Linux kernel versions from 4.19 up to the patched stable releases. The CVSS category is estimated as Medium, with an EPSS score of approximately 0.018% (Feedly, ENISA EUVD).

The root cause is a classic time-of-check/time-of-use race condition classified as CWE-416 (Use After Free). During module unload, at91_adc_remove calls iio_device_unregister(indio_dev), which eventually frees the indio_dev structure. Concurrently, a previously scheduled work queue item (at91_adc_workq_handler) may still be executing and calls iio_push_to_buffers(indio_dev), accessing the now-freed memory. The fix ensures cancel_work_sync() is called on the touch work queue before cleanup proceeds in at91_adc_remove, eliminating the race window (Feedly, ENISA EUVD).

Successful exploitation of this vulnerability could result in kernel memory corruption, potentially leading to a system crash (denial of service) or, in more severe scenarios, privilege escalation if an attacker can control the freed memory region before it is reused. The vulnerability is local in nature and requires the ability to trigger module removal while touch input events are being processed, limiting its practical exploitability to users or processes with sufficient privileges to unload kernel modules. Data confidentiality and integrity impacts are theoretically possible through heap manipulation but are considered unlikely in typical deployment scenarios (Feedly).

The Linux kernel maintainers have released patches across multiple stable branches. Fixed versions include Linux 6.6.122, 6.12.68, 6.18.8, and 6.19-rc7, as well as the mainline kernel (ENISA EUVD). Downstream distributions including Ubuntu (USN-8162-1, USN-8180-1 through USN-8180-6, USN-8186-1, USN-8188-1, USN-8275-1, USN-8278-1, USN-8289-1, USN-8296-1, USN-8297-1) and SUSE have issued updated kernel packages. Users should update to the latest patched kernel version provided by their distribution. As a temporary workaround, avoiding dynamic loading/unloading of the at91-sama5d2_adc module while touch input is active can reduce risk (Ubuntu USN-8162-1, SUSE Advisory).