CVE-2025-71221

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-71221
In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() Add proper locking in mmp_pdma_residue() to prevent use-after-free when accessing descriptor list and descriptor contents. The race occurs when multiple threads call tx_status() while the tasklet on another CPU is freeing completed descriptors: CPU 0 CPU 1 ----- ----- mmp_pdma_tx_status() mmp_pdma_residue() -> NO LOCK held list_for_each_entry(sw, ..) DMA interrupt dma_do_tasklet() -> spin_lock(&desc_lock) list_move(sw->node, ...) spin_unlock(&desc_lock) | dma_pool_free(sw) <- FREED! -> access sw->desc <- UAF! This issue can be reproduced when running dmatest on the same channel with multiple threads (threads_per_chan > 1). Fix by protecting the chain_running list iteration and descriptor access with the chan->desc_lock spinlock.

7.0 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/9f665b3c3d9a168410251f27a5d019b7bf93185c Patch
https://git.kernel.org/stable/c/a143545855bc2c6e1330f6f57ae375ac44af00a7 Patch
https://git.kernel.org/stable/c/dfb5e05227745de43b7fd589721817a4337c970d
https://git.kernel.org/stable/c/eba0c75670c022cb1f948600db972524bcfe8166
https://git.kernel.org/stable/c/fc023b8fab057f0c910856ff36d3e12a30b7af4a
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
History

25 Mar 2026, 11:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/dfb5e05227745de43b7fd589721817a4337c970d -
  • () https://git.kernel.org/stable/c/eba0c75670c022cb1f948600db972524bcfe8166 -
  • () https://git.kernel.org/stable/c/fc023b8fab057f0c910856ff36d3e12a30b7af4a -

18 Mar 2026, 17:26

Type Values Removed Values Added
CWE CWE-362
CPE cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.0
References () https://git.kernel.org/stable/c/9f665b3c3d9a168410251f27a5d019b7bf93185c - () https://git.kernel.org/stable/c/9f665b3c3d9a168410251f27a5d019b7bf93185c - Patch
References () https://git.kernel.org/stable/c/a143545855bc2c6e1330f6f57ae375ac44af00a7 - () https://git.kernel.org/stable/c/a143545855bc2c6e1330f6f57ae375ac44af00a7 - Patch
First Time Linux
Linux linux Kernel

18 Feb 2026, 17:52

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: dmaengine: mmp_pdma: Corrección de condición de carrera en mmp_pdma_residue() Añadir bloqueo adecuado en mmp_pdma_residue() para prevenir uso después de liberación al acceder a la lista de descriptores y al contenido del descriptor. La condición de carrera ocurre cuando múltiples hilos llaman a tx_status() mientras el tasklet en otra CPU está liberando descriptores completados: CPU 0 CPU 1 ----- ----- mmp_pdma_tx_status() mmp_pdma_residue() -&gt; SIN BLOQUEO mantenido list_for_each_entry(sw, ..) Interrupción DMA dma_do_tasklet() -&gt; spin_lock(&amp;desc_lock) list_move(sw-&gt;node, ...) spin_unlock(&amp;desc_lock) | dma_pool_free(sw) &lt;- ¡LIBERADO! -&gt; acceso a sw-&gt;desc &lt;- ¡UAF! Este problema puede ser reproducido al ejecutar dmatest en el mismo canal con múltiples hilos (hilos_por_canal &gt; 1). Solución protegiendo la iteración de la lista chain_running y el acceso al descriptor con el spinlock chan-&gt;desc_lock.

14 Feb 2026, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-14 17:15

Updated : 2026-03-25 11:16

NVD link : CVE-2025-71221

Mitre link : CVE-2025-71221

CVE.ORG link : CVE-2025-71221

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')