CVE-2025-71199: iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver
In the Linux kernel, the following vulnerability has been resolved:
iio: adc: at91-sama5d2adc: Fix potential use-after-free in sama5d2adc driver
at91adcinterrupt can call at91adctouchdatahandler function to start the work by schedulework(&st->touchst.workq).
If we remove the module which will call at91adcremove to make cleanup, it will free indiodev through iiodeviceunregister but quite a bit later. While the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| at91adcworkqhandler at91adcremove | iiodeviceunregister(indiodev) | //free indiodev a bit later | | iiopushtobuffers(indiodev) | //use indiodev
Fix it by ensuring that the work is canceled before proceeding with the cleanup in at91adcremove.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In the at91-sama5d2_adc driver's at91_adc_remove cleanup path, cancel the scheduled touch work before proceeding with iio_device_unregister(indio_dev).
Event History
Frequently Asked Questions
What is the severity of CVE-2025-71199?
CVE-2025-71199 is classified as a medium severity vulnerability.
How do I fix CVE-2025-71199?
To fix CVE-2025-71199, upgrade to the latest version of the Linux kernel that includes the patch for this vulnerability.
What does CVE-2025-71199 impact?
CVE-2025-71199 impacts the at91-sama5d2_adc driver within the Linux kernel.
Is CVE-2025-71199 a local or remote vulnerability?
CVE-2025-71199 is primarily considered a local vulnerability.
What type of vulnerability is CVE-2025-71199?
CVE-2025-71199 is a use-after-free vulnerability.