CVE-2025-71221: 
Chainguard vulnerability analysis and mitigation

CVE-2025-71221 is a race condition (use-after-free) vulnerability in the Linux kernel's mmp_pdma DMA engine component, specifically within the mmp_pdma_residue() function. It affects Linux kernel versions from 3.16 through 6.18.9, as well as 6.19-rc1 through 6.19-rc5. The vulnerability was published on February 14, 2026, and patches were made available in the kernel stable tree. It carries a CVSS v3.1 base score of 7.0 (High) (Feedly).

The root cause is a concurrent execution race condition (CWE-362) in mmp_pdma_residue(), which iterates over the chain_running descriptor list without holding the chan->desc_lock spinlock. When multiple threads invoke tx_status() simultaneously, a DMA interrupt on another CPU can trigger dma_do_tasklet(), which acquires desc_lock, moves a descriptor off the list, and frees it via dma_pool_free(). The first CPU then accesses the already-freed descriptor (sw->desc), resulting in a use-after-free condition. The fix adds spinlock protection around the descriptor list iteration and access in mmp_pdma_residue(). The issue is reproducible using the kernel's dmatest module on the same channel with threads_per_chan > 1 (Feedly, Kernel Patch 1, Kernel Patch 2).

Successful exploitation can result in system crashes (denial of service), memory corruption, or potential arbitrary code execution due to the use-after-free condition. The vulnerability affects confidentiality, integrity, and availability of the system. Because exploitation requires local access and specific threading conditions (multiple threads on the same DMA channel), the practical attack surface is limited primarily to multi-threaded workloads on systems using the MMP PDMA DMA engine (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability requires local privileges and a specific multi-threaded condition (threads_per_chan > 1 on the same DMA channel) to trigger, raising the exploitation bar. The EPSS score is 0.018% (0.000180), reflecting very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly).

Update to Linux kernel version 6.18.10 or later for stable releases, which includes the fix that adds chan->desc_lock spinlock protection around the chain_running list iteration in mmp_pdma_residue(). Specific patches are available in the kernel stable tree at commits 9f665b3c3d9a and a143545855bc. Debian has also issued security advisories (DSA-6238-1, DSA-6243-1, DLA-4561-1) incorporating this fix for its supported kernel packages. Systems not using the MMP PDMA DMA engine are not affected (Feedly, Debian DSA-6238, Debian DSA-6243).