CVE-2025-71154: Linux Kernel Memory Leak Vulnerability

CVE-2025-71154 Overview

CVE-2025-71154 is a memory leak vulnerability in the Linux kernel's rtl8150 USB network driver. The flaw exists in the async_set_registers() function, where a failure in usb_submit_urb() results in allocated memory structures not being properly freed. When URB (USB Request Block) submission fails, the async_req structure and the associated URB remain allocated in memory because the completion callback async_set_reg_cb() is never invoked to clean up these resources.

Critical Impact

Systems using the RTL8150 USB Ethernet adapter may experience memory exhaustion over time if URB submission failures occur repeatedly, potentially leading to system instability or denial of service conditions.

Affected Products

• Linux Kernel (multiple versions with rtl8150 driver)
• Systems utilizing RTL8150-based USB Ethernet adapters
• Embedded Linux devices with USB network support

Discovery Timeline

• 2026-01-23 - CVE CVE-2025-71154 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2025-71154

Vulnerability Analysis

This memory leak vulnerability occurs within the USB subsystem of the Linux kernel, specifically in the rtl8150 network driver's asynchronous register handling mechanism. The async_set_registers() function allocates memory for an async_req structure and a URB to perform asynchronous USB operations. Under normal operation, the completion callback async_set_reg_cb() is responsible for freeing these allocations after the URB completes.

However, if usb_submit_urb() fails during submission, the URB never enters the USB subsystem's processing queue and consequently the completion callback is never triggered. This creates an orphaned memory allocation that persists for the lifetime of the kernel session. In scenarios where URB submission failures occur frequently—such as during USB bus errors, device disconnection events, or resource contention—this leak can accumulate and eventually exhaust available system memory.

Root Cause

The root cause is improper error handling in the async_set_registers() function. The function allocates memory before attempting URB submission but lacks proper cleanup logic in the error path when usb_submit_urb() returns a failure code. The existing code architecture relies entirely on the completion callback for memory deallocation, which creates a design gap when the callback path is never reached due to submission failure.

Attack Vector

This vulnerability has a local attack surface as it requires interaction with the USB subsystem. An attacker with local access could potentially trigger repeated URB submission failures through various means such as:

• Repeatedly connecting and disconnecting USB devices during driver operations
• Inducing USB bus errors through malformed USB traffic or physical manipulation
• Exhausting USB bandwidth or endpoints to force submission failures

The vulnerability manifests in the boundary between successful URB submission and failure handling. When usb_submit_urb() fails, the allocated async_req structure and URB are leaked because the completion callback async_set_reg_cb() is only invoked upon URB completion (successful or otherwise), not upon submission failure. The fix ensures that both the URB and the request structure are freed in the error path when submission fails. For technical implementation details, see the Linux Kernel Commit.

Detection Methods for CVE-2025-71154

Indicators of Compromise

• Gradual increase in kernel memory usage on systems with RTL8150 USB adapters
• Kernel memory allocation failures or OOM (Out of Memory) events in syslog
• Presence of orphaned URB allocations in kernel memory debugging tools like kmemleak
• Unexplained system slowdowns or instability when using USB Ethernet adapters

Detection Strategies

• Enable kernel memory leak detection using CONFIG_DEBUG_KMEMLEAK and monitor for leaks in the rtl8150 driver
• Monitor /proc/meminfo for abnormal Slab memory growth over extended periods
• Use ftrace or perf to track usb_submit_urb() failure rates in the rtl8150 driver
• Implement system health monitoring to alert on sustained memory pressure

Monitoring Recommendations

• Deploy SentinelOne agents on Linux systems to detect anomalous kernel memory behavior
• Configure kernel logging verbosity to capture USB subsystem errors and driver warnings
• Establish baseline memory usage patterns and alert on deviations exceeding normal thresholds
• Monitor dmesg output for rtl8150 driver error messages indicating URB submission failures

How to Mitigate CVE-2025-71154

Immediate Actions Required

• Update the Linux kernel to a patched version that includes the memory leak fix
• If updates are not immediately available, consider temporarily disabling the rtl8150 driver if the USB adapter is not essential
• Monitor affected systems for memory exhaustion symptoms until patches can be applied
• Review and test kernel updates in a staging environment before production deployment

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability across multiple stable branches. The fix properly frees both the URB and the async_req structure in the error path when usb_submit_urb() fails. Patches are available through the following kernel commits:

• Kernel Commit 12cab11
• Kernel Commit 151403e
• Kernel Commit 2f96618
• Kernel Commit 4bd4ea3
• Kernel Commit 6492ad6
• Kernel Commit a4e2442
• Kernel Commit db2244c

Workarounds

• Blacklist the rtl8150 module if the USB Ethernet adapter is not required: add blacklist rtl8150 to /etc/modprobe.d/blacklist.conf
• Use alternative network connectivity methods while awaiting kernel patches
• Implement periodic system reboots as a temporary measure to clear accumulated memory leaks
• Monitor memory usage and configure early warning alerts for memory pressure conditions

# Temporary workaround: Blacklist the vulnerable driver
echo "blacklist rtl8150" | sudo tee /etc/modprobe.d/rtl8150-blacklist.conf
sudo update-initramfs -u

# Verify driver is not loaded
lsmod | grep rtl8150

# Monitor memory usage for leak indicators
watch -n 60 'grep -E "Slab|SUnreclaim" /proc/meminfo'