GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-71145 (GCVE-0-2025-71145)

Vulnerability from cvelistv5 – Published: 2026-01-23 13:39 – Updated: 2026-08-05 12:12
VLAI
Title
usb: phy: isp1301: fix non-OF device reference imbalance
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: phy: isp1301: fix non-OF device reference imbalance A recent change fixing a device reference leak in a UDC driver introduced a potential use-after-free in the non-OF case as the isp1301_get_client() helper only increases the reference count for the returned I2C device in the OF case. Increment the reference count also for non-OF so that the caller can decrement it unconditionally. Note that this is inherently racy just as using the returned I2C device is since nothing is preventing the PHY driver from being unbound while in use.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0c2b0e747010fa645342138d71339a0ecb823bb0 , < 43e58abad6c08c5f0943594126ef4cd6559aac0b (git)
Affected: 33c2e2a87313bc1afe9f7febbbb2014c431a2c5d , < 03bbdaa4da8c6ea0c8431a5011db188a07822c8a (git)
Affected: 8481323710062051b3c42bff94ee5b18a2b496ca , < 75c5d9bce072abbbc09b701a49869ac23c34a906 (git)
Affected: 8bd518ea03b81eb7b4a734b7b901866c448f6c07 , < 5d3df03f70547d4e3fc10ed4381c052eff51b157 (git)
Affected: cefaad839a384a72331aedad927b1944fb6943dc , < 7501ecfe3e5202490c2d13dc7e181203601fcd69 (git)
Affected: c84117912bddd9e5d87e68daf182410c98181407 , < b4b64fda4d30a83a7f00e92a0c8a1d47699609f3 (git)
Affected: 21c7c83d592e6335bfb6d65608da3726f976bad4 (git)
Affected: 5.10.248 , < 5.11 (semver)
guessed Create a notification for this product.
Linux Linux guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/phy/phy-isp1301.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "43e58abad6c08c5f0943594126ef4cd6559aac0b",
              "status": "affected",
              "version": "0c2b0e747010fa645342138d71339a0ecb823bb0",
              "versionType": "git"
            },
            {
              "lessThan": "03bbdaa4da8c6ea0c8431a5011db188a07822c8a",
              "status": "affected",
              "version": "33c2e2a87313bc1afe9f7febbbb2014c431a2c5d",
              "versionType": "git"
            },
            {
              "lessThan": "75c5d9bce072abbbc09b701a49869ac23c34a906",
              "status": "affected",
              "version": "8481323710062051b3c42bff94ee5b18a2b496ca",
              "versionType": "git"
            },
            {
              "lessThan": "5d3df03f70547d4e3fc10ed4381c052eff51b157",
              "status": "affected",
              "version": "8bd518ea03b81eb7b4a734b7b901866c448f6c07",
              "versionType": "git"
            },
            {
              "lessThan": "7501ecfe3e5202490c2d13dc7e181203601fcd69",
              "status": "affected",
              "version": "cefaad839a384a72331aedad927b1944fb6943dc",
              "versionType": "git"
            },
            {
              "lessThan": "b4b64fda4d30a83a7f00e92a0c8a1d47699609f3",
              "status": "affected",
              "version": "c84117912bddd9e5d87e68daf182410c98181407",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "21c7c83d592e6335bfb6d65608da3726f976bad4",
              "versionType": "git"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.248",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/usb/phy/phy-isp1301.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux"
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.248",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: phy: isp1301: fix non-OF device reference imbalance\n\nA recent change fixing a device reference leak in a UDC driver\nintroduced a potential use-after-free in the non-OF case as the\nisp1301_get_client() helper only increases the reference count for the\nreturned I2C device in the OF case.\n\nIncrement the reference count also for non-OF so that the caller can\ndecrement it unconditionally.\n\nNote that this is inherently racy just as using the returned I2C device\nis since nothing is preventing the PHY driver from being unbound while\nin use."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - No network or USB packet handler reaches the faulty reference release. Exploitation requires local interaction with the platform-driver lifecycle or subsequent local use of the dangling kernel objects.\nAC:L - On an affected non-OF deployment, probe-error cleanup or driver removal deterministically drops a reference that was never acquired. No race must be won, and heap reclaim can be attacker-groomed.\nPR:L - Although manual unbind or module removal requires init-namespace administration, the same release occurs during automatic probe-failure cleanup. A basic local user can groom and exercise the resulting published dangling I2C and USB-PHY objects.\nUI:N - Probe and cleanup can occur automatically without a victim performing an action. Subsequent exploitation of the dangling objects requires no user interaction.\nS:U - The corruption affects the kernel and resources governed by the same system security authority. It does not cross a VM, IOMMU, or comparable isolation boundary.\nC:H - The release frees the I2C client and devres-managed ISP1301 object while global pointers and I2C and USB-PHY lists still reference them. Reclaiming these objects can expose arbitrary kernel memory through attacker-shaped stale pointers.\nI:H - Dangling klist operations can modify reclaimed memory, while a reclaimed client can supply a forged adapter and indirect I2C algorithm callbacks. This can provide arbitrary writes and kernel control-flow hijacking.\nA:H - Traversal or use of the dangling client, device-private nodes, or USB-PHY list entry can cause an immediate kernel oops, panic, or invalid function call."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:12:19.804Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/43e58abad6c08c5f0943594126ef4cd6559aac0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/03bbdaa4da8c6ea0c8431a5011db188a07822c8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/75c5d9bce072abbbc09b701a49869ac23c34a906"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d3df03f70547d4e3fc10ed4381c052eff51b157"
        },
        {
          "url": "https://git.kernel.org/stable/c/7501ecfe3e5202490c2d13dc7e181203601fcd69"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4b64fda4d30a83a7f00e92a0c8a1d47699609f3"
        }
      ],
      "title": "usb: phy: isp1301: fix non-OF device reference imbalance",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71145",
    "datePublished": "2026-01-23T13:39:17.857Z",
    "dateReserved": "2026-01-13T15:30:19.661Z",
    "dateUpdated": "2026-08-05T12:12:19.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-71145",
      "date": "2026-09-14",
      "epss": "0.00162",
      "percentile": "0.05701"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-71145\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-01-23T14:16:12.873\",\"lastModified\":\"2026-07-30T06:24:54.403\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nusb: phy: isp1301: fix non-OF device reference imbalance\\n\\nA recent change fixing a device reference leak in a UDC driver\\nintroduced a potential use-after-free in the non-OF case as the\\nisp1301_get_client() helper only increases the reference count for the\\nreturned I2C device in the OF case.\\n\\nIncrement the reference count also for non-OF so that the caller can\\ndecrement it unconditionally.\\n\\nNote that this is inherently racy just as using the returned I2C device\\nis since nothing is preventing the PHY driver from being unbound while\\nin use.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nusb: phy: isp1301: corregir desequilibrio de referencia de dispositivo no-OF\\n\\nUn cambio reciente que correg\u00eda una fuga de referencia de dispositivo en un controlador UDC introdujo un potencial uso despu\u00e9s de liberaci\u00f3n en el caso no-OF, ya que la funci\u00f3n auxiliar isp1301_get_client() solo incrementa el contador de referencias para el dispositivo I2C devuelto en el caso OF.\\n\\nIncrementar el contador de referencias tambi\u00e9n para no-OF para que el llamador pueda decrementarlo incondicionalmente.\\n\\nTenga en cuenta que esto es inherentemente propenso a condiciones de carrera, al igual que lo es usar el dispositivo I2C devuelto, ya que nada impide que el controlador PHY sea desvinculado mientras est\u00e1 en uso.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/usb/phy/phy-isp1301.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"0c2b0e747010fa645342138d71339a0ecb823bb0\",\"lessThan\":\"43e58abad6c08c5f0943594126ef4cd6559aac0b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"33c2e2a87313bc1afe9f7febbbb2014c431a2c5d\",\"lessThan\":\"03bbdaa4da8c6ea0c8431a5011db188a07822c8a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8481323710062051b3c42bff94ee5b18a2b496ca\",\"lessThan\":\"75c5d9bce072abbbc09b701a49869ac23c34a906\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8bd518ea03b81eb7b4a734b7b901866c448f6c07\",\"lessThan\":\"5d3df03f70547d4e3fc10ed4381c052eff51b157\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cefaad839a384a72331aedad927b1944fb6943dc\",\"lessThan\":\"7501ecfe3e5202490c2d13dc7e181203601fcd69\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c84117912bddd9e5d87e68daf182410c98181407\",\"lessThan\":\"b4b64fda4d30a83a7f00e92a0c8a1d47699609f3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"21c7c83d592e6335bfb6d65608da3726f976bad4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.248\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/usb/phy/phy-isp1301.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\"}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-Other\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.248\",\"versionEndExcluding\":\"5.11\",\"matchCriteriaId\":\"27953D46-F1BA-44DF-8344-E000813BC82B\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/03bbdaa4da8c6ea0c8431a5011db188a07822c8a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/43e58abad6c08c5f0943594126ef4cd6559aac0b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5d3df03f70547d4e3fc10ed4381c052eff51b157\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7501ecfe3e5202490c2d13dc7e181203601fcd69\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/75c5d9bce072abbbc09b701a49869ac23c34a906\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b4b64fda4d30a83a7f00e92a0c8a1d47699609f3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-28T07:12:47+00:00",
      "cve": "CVE-2025-71145",
      "id": "CVE-2025-71145",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: usb: phy: isp1301: fix non-OF device reference imbalance",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-71145.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.