CVE-2025-71145

{"id": "CVE-2025-71145", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0c2b0e747010fa645342138d71339a0ecb823bb0", "lessThan": "43e58abad6c08c5f0943594126ef4cd6559aac0b", "versionType": "git"}, {"status": "affected", "version": "33c2e2a87313bc1afe9f7febbbb2014c431a2c5d", "lessThan": "03bbdaa4da8c6ea0c8431a5011db188a07822c8a", "versionType": "git"}, {"status": "affected", "version": "8481323710062051b3c42bff94ee5b18a2b496ca", "lessThan": "75c5d9bce072abbbc09b701a49869ac23c34a906", "versionType": "git"}, {"status": "affected", "version": "8bd518ea03b81eb7b4a734b7b901866c448f6c07", "lessThan": "5d3df03f70547d4e3fc10ed4381c052eff51b157", "versionType": "git"}, {"status": "affected", "version": "cefaad839a384a72331aedad927b1944fb6943dc", "lessThan": "7501ecfe3e5202490c2d13dc7e181203601fcd69", "versionType": "git"}, {"status": "affected", "version": "c84117912bddd9e5d87e68daf182410c98181407", "lessThan": "b4b64fda4d30a83a7f00e92a0c8a1d47699609f3", "versionType": "git"}, {"status": "affected", "version": "21c7c83d592e6335bfb6d65608da3726f976bad4", "versionType": "git"}, {"status": "affected", "version": "5.10.248", "lessThan": "5.11", "versionType": "semver"}], "programFiles": ["drivers/usb/phy/phy-isp1301.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "programFiles": ["drivers/usb/phy/phy-isp1301.c"], "defaultStatus": "unaffected"}]}], "published": "2026-01-23T14:16:12.873", "references": [{"url": "https://git.kernel.org/stable/c/03bbdaa4da8c6ea0c8431a5011db188a07822c8a", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/43e58abad6c08c5f0943594126ef4cd6559aac0b", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5d3df03f70547d4e3fc10ed4381c052eff51b157", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7501ecfe3e5202490c2d13dc7e181203601fcd69", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/75c5d9bce072abbbc09b701a49869ac23c34a906", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b4b64fda4d30a83a7f00e92a0c8a1d47699609f3", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: phy: isp1301: fix non-OF device reference imbalance\n\nA recent change fixing a device reference leak in a UDC driver\nintroduced a potential use-after-free in the non-OF case as the\nisp1301_get_client() helper only increases the reference count for the\nreturned I2C device in the OF case.\n\nIncrement the reference count also for non-OF so that the caller can\ndecrement it unconditionally.\n\nNote that this is inherently racy just as using the returned I2C device\nis since nothing is preventing the PHY driver from being unbound while\nin use."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nusb: phy: isp1301: corregir desequilibrio de referencia de dispositivo no-OF\n\nUn cambio reciente que correg\u00eda una fuga de referencia de dispositivo en un controlador UDC introdujo un potencial uso despu\u00e9s de liberaci\u00f3n en el caso no-OF, ya que la funci\u00f3n auxiliar isp1301_get_client() solo incrementa el contador de referencias para el dispositivo I2C devuelto en el caso OF.\n\nIncrementar el contador de referencias tambi\u00e9n para no-OF para que el llamador pueda decrementarlo incondicionalmente.\n\nTenga en cuenta que esto es inherentemente propenso a condiciones de carrera, al igual que lo es usar el dispositivo I2C devuelto, ya que nada impide que el controlador PHY sea desvinculado mientras est\u00e1 en uso."}], "lastModified": "2026-07-30T06:24:54.403", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "27953D46-F1BA-44DF-8344-E000813BC82B", "versionEndExcluding": "5.11", "versionStartIncluding": "5.10.248"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}