CVE-2025-71162 (GCVE-0-2025-71162)

Vulnerability from cvelistv5 – Published: 2026-01-25 14:36 – Updated: 2026-08-05 12:12
VLAI
Title
dmaengine: tegra-adma: Fix use-after-free
Summary
In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra-adma: Fix use-after-free A use-after-free bug exists in the Tegra ADMA driver when audio streams are terminated, particularly during XRUN conditions. The issue occurs when the DMA buffer is freed by tegra_adma_terminate_all() before the vchan completion tasklet finishes accessing it. The race condition follows this sequence: 1. DMA transfer completes, triggering an interrupt that schedules the completion tasklet (tasklet has not executed yet) 2. Audio playback stops, calling tegra_adma_terminate_all() which frees the DMA buffer memory via kfree() 3. The scheduled tasklet finally executes, calling vchan_complete() which attempts to access the already-freed memory Since tasklets can execute at any time after being scheduled, there is no guarantee that the buffer will remain valid when vchan_complete() runs. Fix this by properly synchronizing the virtual channel completion: - Calling vchan_terminate_vdesc() in tegra_adma_stop() to mark the descriptors as terminated instead of freeing the descriptor. - Add the callback tegra_adma_synchronize() that calls vchan_synchronize() which kills any pending tasklets and frees any terminated descriptors. Crash logs: [ 337.427523] BUG: KASAN: use-after-free in vchan_complete+0x124/0x3b0 [ 337.427544] Read of size 8 at addr ffff000132055428 by task swapper/0/0 [ 337.427562] Call trace: [ 337.427564] dump_backtrace+0x0/0x320 [ 337.427571] show_stack+0x20/0x30 [ 337.427575] dump_stack_lvl+0x68/0x84 [ 337.427584] print_address_description.constprop.0+0x74/0x2b8 [ 337.427590] kasan_report+0x1f4/0x210 [ 337.427598] __asan_load8+0xa0/0xd0 [ 337.427603] vchan_complete+0x124/0x3b0 [ 337.427609] tasklet_action_common.constprop.0+0x190/0x1d0 [ 337.427617] tasklet_action+0x30/0x40 [ 337.427623] __do_softirq+0x1a0/0x5c4 [ 337.427628] irq_exit+0x110/0x140 [ 337.427633] handle_domain_irq+0xa4/0xe0 [ 337.427640] gic_handle_irq+0x64/0x160 [ 337.427644] call_on_irq_stack+0x20/0x4c [ 337.427649] do_interrupt_handler+0x7c/0x90 [ 337.427654] el1_interrupt+0x30/0x80 [ 337.427659] el1h_64_irq_handler+0x18/0x30 [ 337.427663] el1h_64_irq+0x7c/0x80 [ 337.427667] cpuidle_enter_state+0xe4/0x540 [ 337.427674] cpuidle_enter+0x54/0x80 [ 337.427679] do_idle+0x2e0/0x380 [ 337.427685] cpu_startup_entry+0x2c/0x70 [ 337.427690] rest_init+0x114/0x130 [ 337.427695] arch_call_rest_init+0x18/0x24 [ 337.427702] start_kernel+0x380/0x3b4 [ 337.427706] __primary_switched+0xc0/0xc8
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f46b195799b5cb05338e7c44cb3617eacb56d755 , < 5f8d1d66a952d0396671e1f21ff8127a4d14fb4e (git)
Affected: f46b195799b5cb05338e7c44cb3617eacb56d755 , < 76992310f80776b4d1f7f8915f59b92883a3e44c (git)
Affected: f46b195799b5cb05338e7c44cb3617eacb56d755 , < ae3eed72de682ddbba507ed2d6b848c21a6b721e (git)
Affected: f46b195799b5cb05338e7c44cb3617eacb56d755 , < 59cb421b0902fbef2b9512ae8ba198a20f26b41f (git)
Affected: f46b195799b5cb05338e7c44cb3617eacb56d755 , < cb2c9c4bb1322cc3c9984ad17db8cdd2663879ca (git)
Affected: f46b195799b5cb05338e7c44cb3617eacb56d755 , < be655c3736b3546f39bc8116ffbf2a3b6cac96c4 (git)
Affected: f46b195799b5cb05338e7c44cb3617eacb56d755 , < 2efd07a7c36949e6fa36a69183df24d368bf9e96 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.7
Unaffected: 0 , < 4.7 (semver)
Unaffected: 5.10.249 , ≤ 5.10.* (semver)
Unaffected: 5.15.199 , ≤ 5.15.* (semver)
Unaffected: 6.1.162 , ≤ 6.1.* (semver)
Unaffected: 6.6.122 , ≤ 6.6.* (semver)
Unaffected: 6.12.67 , ≤ 6.12.* (semver)
Unaffected: 6.18.7 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:44:49.681Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/tegra210-adma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5f8d1d66a952d0396671e1f21ff8127a4d14fb4e",
              "status": "affected",
              "version": "f46b195799b5cb05338e7c44cb3617eacb56d755",
              "versionType": "git"
            },
            {
              "lessThan": "76992310f80776b4d1f7f8915f59b92883a3e44c",
              "status": "affected",
              "version": "f46b195799b5cb05338e7c44cb3617eacb56d755",
              "versionType": "git"
            },
            {
              "lessThan": "ae3eed72de682ddbba507ed2d6b848c21a6b721e",
              "status": "affected",
              "version": "f46b195799b5cb05338e7c44cb3617eacb56d755",
              "versionType": "git"
            },
            {
              "lessThan": "59cb421b0902fbef2b9512ae8ba198a20f26b41f",
              "status": "affected",
              "version": "f46b195799b5cb05338e7c44cb3617eacb56d755",
              "versionType": "git"
            },
            {
              "lessThan": "cb2c9c4bb1322cc3c9984ad17db8cdd2663879ca",
              "status": "affected",
              "version": "f46b195799b5cb05338e7c44cb3617eacb56d755",
              "versionType": "git"
            },
            {
              "lessThan": "be655c3736b3546f39bc8116ffbf2a3b6cac96c4",
              "status": "affected",
              "version": "f46b195799b5cb05338e7c44cb3617eacb56d755",
              "versionType": "git"
            },
            {
              "lessThan": "2efd07a7c36949e6fa36a69183df24d368bf9e96",
              "status": "affected",
              "version": "f46b195799b5cb05338e7c44cb3617eacb56d755",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/dma/tegra210-adma.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.249",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.122",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.67",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.249",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.199",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.122",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.67",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.7",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: tegra-adma: Fix use-after-free\n\nA use-after-free bug exists in the Tegra ADMA driver when audio streams\nare terminated, particularly during XRUN conditions. The issue occurs\nwhen the DMA buffer is freed by tegra_adma_terminate_all() before the\nvchan completion tasklet finishes accessing it.\n\nThe race condition follows this sequence:\n\n  1. DMA transfer completes, triggering an interrupt that schedules the\n     completion tasklet (tasklet has not executed yet)\n  2. Audio playback stops, calling tegra_adma_terminate_all() which\n     frees the DMA buffer memory via kfree()\n  3. The scheduled tasklet finally executes, calling vchan_complete()\n     which attempts to access the already-freed memory\n\nSince tasklets can execute at any time after being scheduled, there is\nno guarantee that the buffer will remain valid when vchan_complete()\nruns.\n\nFix this by properly synchronizing the virtual channel completion:\n - Calling vchan_terminate_vdesc() in tegra_adma_stop() to mark the\n   descriptors as terminated instead of freeing the descriptor.\n - Add the callback tegra_adma_synchronize() that calls\n   vchan_synchronize() which kills any pending tasklets and frees any\n   terminated descriptors.\n\nCrash logs:\n[  337.427523] BUG: KASAN: use-after-free in vchan_complete+0x124/0x3b0\n[  337.427544] Read of size 8 at addr ffff000132055428 by task swapper/0/0\n\n[  337.427562] Call trace:\n[  337.427564]  dump_backtrace+0x0/0x320\n[  337.427571]  show_stack+0x20/0x30\n[  337.427575]  dump_stack_lvl+0x68/0x84\n[  337.427584]  print_address_description.constprop.0+0x74/0x2b8\n[  337.427590]  kasan_report+0x1f4/0x210\n[  337.427598]  __asan_load8+0xa0/0xd0\n[  337.427603]  vchan_complete+0x124/0x3b0\n[  337.427609]  tasklet_action_common.constprop.0+0x190/0x1d0\n[  337.427617]  tasklet_action+0x30/0x40\n[  337.427623]  __do_softirq+0x1a0/0x5c4\n[  337.427628]  irq_exit+0x110/0x140\n[  337.427633]  handle_domain_irq+0xa4/0xe0\n[  337.427640]  gic_handle_irq+0x64/0x160\n[  337.427644]  call_on_irq_stack+0x20/0x4c\n[  337.427649]  do_interrupt_handler+0x7c/0x90\n[  337.427654]  el1_interrupt+0x30/0x80\n[  337.427659]  el1h_64_irq_handler+0x18/0x30\n[  337.427663]  el1h_64_irq+0x7c/0x80\n[  337.427667]  cpuidle_enter_state+0xe4/0x540\n[  337.427674]  cpuidle_enter+0x54/0x80\n[  337.427679]  do_idle+0x2e0/0x380\n[  337.427685]  cpu_startup_entry+0x2c/0x70\n[  337.427690]  rest_init+0x114/0x130\n[  337.427695]  arch_call_rest_init+0x18/0x24\n[  337.427702]  start_kernel+0x380/0x3b4\n[  337.427706]  __primary_switched+0xc0/0xc8"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached locally through ALSA PCM device ioctls that flow through ASoC and DMAengine into the Tegra ADMA driver; it is not packet-facing.\nAC:L - The attacker controls stream setup, period sizing, and repeated start/termination while causing the hardware period interrupts. A public looped reproducer reliably drives the race window.\nPR:L - No capability or namespace privilege check exists; the process needs only ordinary permission to open the ALSA PCM device, commonly granted to an unprivileged audio-session user.\nUI:N - The attacker can configure, start, and terminate their own PCM stream or induce its XRUN without any separate victim action.\nS:U - The corruption and its effects remain within the host kernel security authority; this is not a guest-host, IOMMU, or other security-boundary bypass.\nC:H - The freed kmalloc-256 descriptor is subsequently dereferenced for callback fields; reclaiming it can enable attacker-influenced kernel execution and arbitrary kernel-memory disclosure.\nI:H - vchan_complete() reads function pointers and a callback parameter from the freed descriptor and invokes a callback, supporting control-flow hijacking and arbitrary kernel modification.\nA:H - The KASAN-confirmed use-after-free can cause a kernel oops or panic, and the attacker can repeat the stream termination or XRUN sequence."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:12:27.337Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5f8d1d66a952d0396671e1f21ff8127a4d14fb4e"
        },
        {
          "url": "https://git.kernel.org/stable/c/76992310f80776b4d1f7f8915f59b92883a3e44c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae3eed72de682ddbba507ed2d6b848c21a6b721e"
        },
        {
          "url": "https://git.kernel.org/stable/c/59cb421b0902fbef2b9512ae8ba198a20f26b41f"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb2c9c4bb1322cc3c9984ad17db8cdd2663879ca"
        },
        {
          "url": "https://git.kernel.org/stable/c/be655c3736b3546f39bc8116ffbf2a3b6cac96c4"
        },
        {
          "url": "https://git.kernel.org/stable/c/2efd07a7c36949e6fa36a69183df24d368bf9e96"
        }
      ],
      "title": "dmaengine: tegra-adma: Fix use-after-free",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71162",
    "datePublished": "2026-01-25T14:36:09.029Z",
    "dateReserved": "2026-01-13T15:30:19.666Z",
    "dateUpdated": "2026-08-05T12:12:27.337Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-71162",
      "date": "2026-08-17",
      "epss": "0.00189",
      "percentile": "0.08805"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-03T01:39:16.000Z",
      "cve": "CVE-2025-71162",
      "id": "msrc_CVE-2025-71162",
      "initial_release_date": "2026-01-02T00:00:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "dmaengine: tegra-adma: Fix use-after-free",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2025-71162.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-71162\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-01-25T15:15:53.947\",\"lastModified\":\"2026-07-30T06:24:55.260\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndmaengine: tegra-adma: Fix use-after-free\\n\\nA use-after-free bug exists in the Tegra ADMA driver when audio streams\\nare terminated, particularly during XRUN conditions. The issue occurs\\nwhen the DMA buffer is freed by tegra_adma_terminate_all() before the\\nvchan completion tasklet finishes accessing it.\\n\\nThe race condition follows this sequence:\\n\\n  1. DMA transfer completes, triggering an interrupt that schedules the\\n     completion tasklet (tasklet has not executed yet)\\n  2. Audio playback stops, calling tegra_adma_terminate_all() which\\n     frees the DMA buffer memory via kfree()\\n  3. The scheduled tasklet finally executes, calling vchan_complete()\\n     which attempts to access the already-freed memory\\n\\nSince tasklets can execute at any time after being scheduled, there is\\nno guarantee that the buffer will remain valid when vchan_complete()\\nruns.\\n\\nFix this by properly synchronizing the virtual channel completion:\\n - Calling vchan_terminate_vdesc() in tegra_adma_stop() to mark the\\n   descriptors as terminated instead of freeing the descriptor.\\n - Add the callback tegra_adma_synchronize() that calls\\n   vchan_synchronize() which kills any pending tasklets and frees any\\n   terminated descriptors.\\n\\nCrash logs:\\n[  337.427523] BUG: KASAN: use-after-free in vchan_complete+0x124/0x3b0\\n[  337.427544] Read of size 8 at addr ffff000132055428 by task swapper/0/0\\n\\n[  337.427562] Call trace:\\n[  337.427564]  dump_backtrace+0x0/0x320\\n[  337.427571]  show_stack+0x20/0x30\\n[  337.427575]  dump_stack_lvl+0x68/0x84\\n[  337.427584]  print_address_description.constprop.0+0x74/0x2b8\\n[  337.427590]  kasan_report+0x1f4/0x210\\n[  337.427598]  __asan_load8+0xa0/0xd0\\n[  337.427603]  vchan_complete+0x124/0x3b0\\n[  337.427609]  tasklet_action_common.constprop.0+0x190/0x1d0\\n[  337.427617]  tasklet_action+0x30/0x40\\n[  337.427623]  __do_softirq+0x1a0/0x5c4\\n[  337.427628]  irq_exit+0x110/0x140\\n[  337.427633]  handle_domain_irq+0xa4/0xe0\\n[  337.427640]  gic_handle_irq+0x64/0x160\\n[  337.427644]  call_on_irq_stack+0x20/0x4c\\n[  337.427649]  do_interrupt_handler+0x7c/0x90\\n[  337.427654]  el1_interrupt+0x30/0x80\\n[  337.427659]  el1h_64_irq_handler+0x18/0x30\\n[  337.427663]  el1h_64_irq+0x7c/0x80\\n[  337.427667]  cpuidle_enter_state+0xe4/0x540\\n[  337.427674]  cpuidle_enter+0x54/0x80\\n[  337.427679]  do_idle+0x2e0/0x380\\n[  337.427685]  cpu_startup_entry+0x2c/0x70\\n[  337.427690]  rest_init+0x114/0x130\\n[  337.427695]  arch_call_rest_init+0x18/0x24\\n[  337.427702]  start_kernel+0x380/0x3b4\\n[  337.427706]  __primary_switched+0xc0/0xc8\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\ndmaengine: tegra-adma: Correcci\u00f3n de uso despu\u00e9s de liberaci\u00f3n\\n\\nExiste un error de uso despu\u00e9s de liberaci\u00f3n en el controlador Tegra ADMA cuando las transmisiones de audio son terminadas, particularmente durante condiciones XRUN. El problema ocurre cuando el b\u00fafer DMA es liberado por tegra_adma_terminate_all() antes de que la tarea de finalizaci\u00f3n de vchan termine de acceder a \u00e9l.\\n\\nLa condici\u00f3n de carrera sigue esta secuencia:\\n\\n  1. La transferencia DMA se completa, desencadenando una interrupci\u00f3n que programa la tarea de finalizaci\u00f3n (la tarea a\u00fan no se ha ejecutado)\\n  2. La reproducci\u00f3n de audio se detiene, llamando a tegra_adma_terminate_all() que libera la memoria del b\u00fafer DMA a trav\u00e9s de kfree()\\n  3. La tarea programada finalmente se ejecuta, llamando a vchan_complete() que intenta acceder a la memoria ya liberada\\n\\nDado que las tareas pueden ejecutarse en cualquier momento despu\u00e9s de ser programadas, no hay garant\u00eda de que el b\u00fafer permanezca v\u00e1lido cuando se ejecuta vchan_complete().\\n\\nCorrija esto mediante la sincronizaci\u00f3n adecuada de la finalizaci\u00f3n del canal virtual:\\n - Llamando a vchan_terminate_vdesc() en tegra_adma_stop() para marcar los descriptores como terminados en lugar de liberar el descriptor.\\n - Agregue la funci\u00f3n de devoluci\u00f3n de llamada tegra_adma_synchronize() que llama a vchan_synchronize() que elimina cualquier tarea pendiente y libera cualquier descriptor terminado.\\n\\nRegistros de fallos:\\n[  337.427523] BUG: KASAN: uso despu\u00e9s de liberaci\u00f3n en vchan_complete+0x124/0x3b0\\n[  337.427544] Lectura de tama\u00f1o 8 en la direcci\u00f3n ffff000132055428 por la tarea swapper/0/0\\n\\n[  337.427562] Traza de llamada:\\n[  337.427564]  dump_backtrace+0x0/0x320\\n[  337.427571]  show_stack+0x20/0x30\\n[  337.427575]  dump_stack_lvl+0x68/0x84\\n[  337.427584]  print_address_description.constprop.0+0x74/0x2b8\\n[  337.427590]  kasan_report+0x1f4/0x210\\n[  337.427598]  __asan_load8+0xa0/0xd0\\n[  337.427603]  vchan_complete+0x124/0x3b0\\n[  337.427609]  tasklet_action_common.constprop.0+0x190/0x1d0\\n[  337.427617]  tasklet_action+0x30/0x40\\n[  337.427623]  __do_softirq+0x1a0/0x5c4\\n[  337.427628]  irq_exit+0x110/0x140\\n[  337.427633]  handle_domain_irq+0xa4/0xe0\\n[  337.427640]  gic_handle_irq+0x64/0x160\\n[  337.427644]  call_on_irq_stack+0x20/0x4c\\n[  337.427649]  do_interrupt_handler+0x7c/0x90\\n[  337.427654]  el1_interrupt+0x30/0x80\\n[  337.427659]  el1h_64_irq_handler+0x18/0x30\\n[  337.427663]  el1h_64_irq+0x7c/0x80\\n[  337.427667]  cpuidle_enter_state+0xe4/0x540\\n[  337.427674]  cpuidle_enter+0x54/0x80\\n[  337.427679]  do_idle+0x2e0/0x380\\n[  337.427685]  cpu_startup_entry+0x2c/0x70\\n[  337.427690]  rest_init+0x114/0x130\\n[  337.427695]  arch_call_rest_init+0x18/0x24\\n[  337.427702]  start_kernel+0x380/0x3b4\\n[  337.427706]  __primary_switched+0xc0/0xc8\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/dma/tegra210-adma.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f46b195799b5cb05338e7c44cb3617eacb56d755\",\"lessThan\":\"5f8d1d66a952d0396671e1f21ff8127a4d14fb4e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f46b195799b5cb05338e7c44cb3617eacb56d755\",\"lessThan\":\"76992310f80776b4d1f7f8915f59b92883a3e44c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f46b195799b5cb05338e7c44cb3617eacb56d755\",\"lessThan\":\"ae3eed72de682ddbba507ed2d6b848c21a6b721e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f46b195799b5cb05338e7c44cb3617eacb56d755\",\"lessThan\":\"59cb421b0902fbef2b9512ae8ba198a20f26b41f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f46b195799b5cb05338e7c44cb3617eacb56d755\",\"lessThan\":\"cb2c9c4bb1322cc3c9984ad17db8cdd2663879ca\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f46b195799b5cb05338e7c44cb3617eacb56d755\",\"lessThan\":\"be655c3736b3546f39bc8116ffbf2a3b6cac96c4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f46b195799b5cb05338e7c44cb3617eacb56d755\",\"lessThan\":\"2efd07a7c36949e6fa36a69183df24d368bf9e96\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/dma/tegra210-adma.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.249\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.199\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.162\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.122\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.67\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.7\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.7\",\"versionEndExcluding\":\"5.10.249\",\"matchCriteriaId\":\"B0DD2984-3956-42EA-93D4-6A5896208E47\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.199\",\"matchCriteriaId\":\"A247FBA6-BEB9-484F-B892-DD5517949CCD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.162\",\"matchCriteriaId\":\"6579E0D4-0641-479D-A4C3-0EF618798C55\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.122\",\"matchCriteriaId\":\"8EAAE395-0162-4BAF-9AD5-E9AF3C869C4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.67\",\"matchCriteriaId\":\"7456F614-6AA8-4C08-8229-BA342D4AFBAD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.7\",\"matchCriteriaId\":\"99FF3E05-0E7A-44E9-8E47-BF6F1F8EC436\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"17B67AA7-40D6-4AFA-8459-F200F3D7CFD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"C47E4CC9-C826-4FA9-B014-7FE3D9B318B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F71D92C0-C023-48BD-B3B6-70B638EEE298\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"13580667-0A98-40CC-B29F-D12790B91BDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2efd07a7c36949e6fa36a69183df24d368bf9e96\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/59cb421b0902fbef2b9512ae8ba198a20f26b41f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5f8d1d66a952d0396671e1f21ff8127a4d14fb4e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/76992310f80776b4d1f7f8915f59b92883a3e44c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ae3eed72de682ddbba507ed2d6b848c21a6b721e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/be655c3736b3546f39bc8116ffbf2a3b6cac96c4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cb2c9c4bb1322cc3c9984ad17db8cdd2663879ca\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-13T17:32:36+00:00",
      "cve": "CVE-2025-71162",
      "id": "CVE-2025-71162",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel Tegra ADMA driver: Use-after-free vulnerability causes system crash",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-71162.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.