CVE-2025-71154: net: usb: rtl8150: fix memory leak on usb_submit_urb() failure
In the Linux kernel, the following vulnerability has been resolved:
net: usb: rtl8150: fix memory leak on usbsubmiturb() failure
In asyncsetregisters(), when usbsubmiturb() fails, the allocated asyncreq structure and URB are not freed, causing a memory leak.
The completion callback asyncsetregcb() is responsible for freeing these allocations, but it is only called after the URB is successfully submitted and completes (successfully or with error). If submission fails, the callback never runs and the memory is leaked.
Fix this by freeing both the URB and the request structure in the error path when usbsubmiturb() fails.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71154?
CVE-2025-71154 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2025-71154?
To fix CVE-2025-71154, update your Linux kernel to the latest patched version provided by your distribution.
What causes CVE-2025-71154?
CVE-2025-71154 is caused by a memory leak that occurs when usb_submit_urb() fails, and the async_req structure is not properly cleaned up.
Which versions of the Linux kernel are affected by CVE-2025-71154?
CVE-2025-71154 affects versions of the Linux kernel that include the rtl8150 USB driver without the memory leak fix.
Is CVE-2025-71154 remotely exploitable?
CVE-2025-71154 is not considered remotely exploitable as it requires local access to trigger the memory leak.