CVE-2025-71158

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-71158", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:30:19.665Z", "datePublished": "2026-01-23T15:23:57.016Z", "dateUpdated": "2026-08-05T12:12:24.125Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:12:24.125Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: mpsse: ensure worker is torn down\n\nWhen an IRQ worker is running, unplugging the device would cause a\ncrash. The sealevel hardware this driver was written for was not\nhotpluggable, so I never realized it.\n\nThis change uses a spinlock to protect a list of workers, which\nit tears down on disconnect."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - A local caller with write access to the USB device node can issue USBDEVFS_IOCTL containing USBDEVFS_DISCONNECT, which synchronously reaches gpio_mpsse_disconnect(); physical unplugging is an additional path.\nAC:L - The attacker can arm edge detection through GPIO_V2_GET_LINE_IOCTL and then initiate software disconnect, controlling both sides of the race. The continuously running polling worker makes repeated triggering practical.\nPR:L - Neither the GPIO request nor USBFS disconnect path performs a capable() or ns_capable() check; access is governed only by device-node DAC/LSM policy, so a basic user granted device access suffices.\nUI:N - No victim action is required after the attacker arms the worker and disconnects the interface, and deployed controller services may already keep GPIO edge IRQs continuously active.\nS:U - The vulnerable worker and affected resources are within the same host-kernel security authority, with no VM, IOMMU, or other security-boundary crossing.\nC:H - The worker can continue dereferencing a devm-freed mpsse_priv containing kernel pointers and synchronization objects, allowing attacker-influenced reclaimed contents to support kernel-memory disclosure.\nI:H - The use-after-free performs operations through reclaimed pointers and mutexes, while the reclaimed gpio.ngpio value controls loops over fixed 16-entry stack arrays, making arbitrary corruption and control-flow hijacking defensible.\nA:H - The documented outcome is a kernel crash on disconnect, reachable through immediate NULL dereferences or subsequent use-after-free accesses by the unterminated worker."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpio/gpio-mpsse.c"], "versions": [{"version": "c46a74ff05c0ac76ba11ef21c930c3b447abf31a", "lessThan": "472d900c8bcac301ae0e40fdca7db799bd989ff5", "status": "affected", "versionType": "git"}, {"version": "c46a74ff05c0ac76ba11ef21c930c3b447abf31a", "lessThan": "179ef1127d7a4f09f0e741fa9f30b8a8e7886271", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpio/gpio-mpsse.c"], "versions": [{"version": "6.13", "status": "affected"}, {"version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.6", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/472d900c8bcac301ae0e40fdca7db799bd989ff5"}, {"url": "https://git.kernel.org/stable/c/179ef1127d7a4f09f0e741fa9f30b8a8e7886271"}], "title": "gpio: mpsse: ensure worker is torn down", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpio/gpio-mpsse.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "472d900c8bcac301ae0e40fdca7db799bd989ff5", "status": "affected", "version": "c46a74ff05c0ac76ba11ef21c930c3b447abf31a", "versionType": "git"}, {"lessThan": "179ef1127d7a4f09f0e741fa9f30b8a8e7886271", "status": "affected", "version": "c46a74ff05c0ac76ba11ef21c930c3b447abf31a", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpio/gpio-mpsse.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"lessThan": "6.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "879529BC-5B4C-4EBE-BF1D-1A31404A8B2E", "versionEndExcluding": "6.18.6", "versionStartIncluding": "6.13", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: mpsse: ensure worker is torn down\n\nWhen an IRQ worker is running, unplugging the device would cause a\ncrash. The sealevel hardware this driver was written for was not\nhotpluggable, so I never realized it.\n\nThis change uses a spinlock to protect a list of workers, which\nit tears down on disconnect."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ngpio: mpsse: asegurar que el worker se desmonte\n\nCuando un worker IRQ est\u00e1 en ejecuci\u00f3n, desenchufar el dispositivo causar\u00eda un fallo. El hardware sealevel para el que se escribi\u00f3 este controlador no era hotpluggable, as\u00ed que nunca me di cuenta.\n\nEste cambio utiliza un spinlock para proteger una lista de workers, la cual desmonta al desconectar."}], "id": "CVE-2025-71158", "lastModified": "2026-07-30T06:24:54.880", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-01-23T16:15:52.690", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/179ef1127d7a4f09f0e741fa9f30b8a8e7886271"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/472d900c8bcac301ae0e40fdca7db799bd989ff5"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: gpio: mpsse: ensure worker is torn down", "id": "2432395", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2432395"}, "csaw": false, "details": ["No description is available for this CVE."], "name": "CVE-2025-71158", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-01-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-71158\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-71158\nhttps://lore.kernel.org/linux-cve-announce/2026012344-CVE-2025-71158-1cfa@gregkh/T"], "threat_severity": "Moderate"}

{}