CVE-2025-71199
Description
In the Linux kernel, the following vulnerability has been resolved: iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver at91_adc_interrupt can call at91_adc_touch_data_handler function to start the work by schedule_work(&st->touch_st.workq). If we remove the module which will call at91_adc_remove to make cleanup, it will free indio_dev through iio_device_unregister but quite a bit later. While the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | at91_adc_workq_handler at91_adc_remove | iio_device_unregister(indio_dev) | //free indio_dev a bit later | | iio_push_to_buffers(indio_dev) | //use indio_dev Fix it by ensuring that the work is canceled before proceeding with the cleanup in at91_adc_remove.
How to fix
- Linux Linux4c83dd62595ee7b7c9298a4d19a256b6647e7240, fdc8c835c637a3473878d1e7438c77ab8928af63, 919d176b05776c7ede79c36744c823a07d631617, 9795fe80976f8c31cafda7d44edfc0f532d1f7c4, d7b6fc224c7f5d6d8adcb18037138d3cfe2bbdfe, d890234a91570542c228a20f132ce74f9fedd904, dbdb442218cd9d613adeab31a88ac973f22c4873 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 23ec2774f1cc168b1f32a2e0ed2709cb473bb94e ≤ v < 4c83dd62595ee7b7c9298a4d19a256b6647e7240, 23ec2774f1cc168b1f32a2e0ed2709cb473bb94e ≤ v < fdc8c835c637a3473878d1e7438c77ab8928af63, 23ec2774f1cc168b1f32a2e0ed2709cb473bb94e ≤ v < 919d176b05776c7ede79c36744c823a07d631617, 23ec2774f1cc168b1f32a2e0ed2709cb473bb94e ≤ v < 9795fe80976f8c31cafda7d44edfc0f532d1f7c4, 23ec2774f1cc168b1f32a2e0ed2709cb473bb94e ≤ v < d7b6fc224c7f5d6d8adcb18037138d3cfe2bbdfe, 23ec2774f1cc168b1f32a2e0ed2709cb473bb94e ≤ v < d890234a91570542c228a20f132ce74f9fedd904, 23ec2774f1cc168b1f32a2e0ed2709cb473bb94e ≤ v < dbdb442218cd9d613adeab31a88ac973f22c4873, 4.19 | 4c83dd62595ee7b7c9298a4d19a256b6647e7240, fdc8c835c637a3473878d1e7438c77ab8928af63, 919d176b05776c7ede79c36744c823a07d631617, 9795fe80976f8c31cafda7d44edfc0f532d1f7c4, d7b6fc224c7f5d6d8adcb18037138d3cfe2bbdfe, d890234a91570542c228a20f132ce74f9fedd904, dbdb442218cd9d613adeab31a88ac973f22c4873 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.