CVE-2025-71162: Linux Kernel Use-After-Free Vulnerability

CVE-2025-71162 Overview

A use-after-free vulnerability exists in the Linux kernel's Tegra ADMA (Audio Direct Memory Access) driver that can be triggered when audio streams are terminated, particularly during XRUN (buffer underrun/overrun) conditions. The flaw occurs due to improper synchronization between DMA buffer deallocation and tasklet completion, creating a race condition that allows access to freed memory.

Critical Impact

Local attackers could potentially exploit this use-after-free condition to cause system crashes, denial of service, or potentially achieve privilege escalation by corrupting kernel memory structures.

Affected Products

• Linux kernel with Tegra ADMA driver enabled
• NVIDIA Tegra-based systems running affected kernel versions
• Systems utilizing audio playback through the Tegra ADMA subsystem

Discovery Timeline

• 2026-01-25 - CVE CVE-2025-71162 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2025-71162

Vulnerability Analysis

This use-after-free vulnerability stems from a race condition in the Tegra ADMA driver's handling of DMA transfer completion and audio stream termination. The issue manifests when the virtual channel (vchan) completion tasklet attempts to access DMA buffer memory that has already been freed by tegra_adma_terminate_all().

The vulnerability is particularly concerning because tasklets in the Linux kernel are deferred work mechanisms that can execute at unpredictable times after being scheduled. This asynchronous execution model creates a window where buffer memory can be deallocated while a scheduled tasklet still holds a reference to it.

When KASAN (Kernel Address Sanitizer) detects this condition, it reports an invalid 8-byte read at the address of the freed buffer, indicating that vchan_complete() is attempting to access deallocated memory during tasklet execution from the softirq context.

Root Cause

The root cause is insufficient synchronization between two concurrent operations in the Tegra ADMA driver:

1. The DMA completion interrupt handler schedules a tasklet to process completion callbacks
2. The tegra_adma_terminate_all() function frees DMA buffer memory via kfree() without waiting for pending tasklets to complete

This creates a Time-of-Check Time-of-Use (TOCTOU) style race where the buffer validity check (implicit in the tasklet scheduling) occurs before the buffer is freed, but the actual buffer use (in vchan_complete()) occurs after deallocation.

Attack Vector

The attack follows a specific sequence of events during audio playback termination:

1. A DMA transfer completes normally, triggering an interrupt that schedules the vchan_complete() tasklet for deferred execution
2. Before the tasklet executes, audio playback stops (possibly due to an XRUN condition or user action)
3. The tegra_adma_terminate_all() function is called, which immediately frees the DMA buffer memory
4. The previously scheduled tasklet finally executes, calling vchan_complete() which attempts to access the now-freed memory at address ffff000132055428

The crash trace shows this occurring in the idle CPU context (do_idle), indicating the tasklet ran during system idle time after the buffer was already freed.

Detection Methods for CVE-2025-71162

Indicators of Compromise

• Kernel panic or oops messages referencing vchan_complete in the call trace
• KASAN reports showing use-after-free violations in the tegra-adma or vchan subsystems
• System crashes occurring during or immediately after audio playback termination
• Unexplained memory corruption symptoms on Tegra-based systems with audio workloads

Detection Strategies

• Enable KASAN (Kernel Address Sanitizer) in development and testing environments to detect use-after-free conditions early
• Monitor kernel logs for BUG: KASAN: use-after-free messages with vchan_complete in the stack trace
• Implement kernel crash dump collection and analysis to identify this specific crash signature
• Use ftrace or eBPF to monitor tegra_adma_terminate_all() and vchan_complete() execution ordering

Monitoring Recommendations

• Configure kernel crash dump mechanisms (kdump) to capture diagnostic information when crashes occur
• Set up automated log monitoring for KASAN violation reports on Tegra-based systems
• Implement audio subsystem health monitoring to detect abnormal termination patterns
• Deploy runtime memory debugging tools in non-production environments to catch similar race conditions

How to Mitigate CVE-2025-71162

Immediate Actions Required

• Update the Linux kernel to a patched version containing the fix for this vulnerability
• If running affected kernel versions, consider disabling or limiting use of Tegra ADMA functionality until patches can be applied
• Review system logs for evidence of past exploitation attempts or crashes matching this vulnerability pattern
• Prioritize patching for systems actively using audio playback through the Tegra ADMA subsystem

Patch Information

The fix implements proper synchronization for virtual channel completion by making the following changes:

1. Modified tegra_adma_stop(): Now calls vchan_terminate_vdesc() to mark descriptors as terminated rather than immediately freeing them
2. Added tegra_adma_synchronize() callback: This new function calls vchan_synchronize() which properly kills any pending tasklets and ensures terminated descriptors are freed only after all tasklet activity has completed

The patches are available in the stable kernel tree:

• Kernel Commit 2efd07a7c369
• Kernel Commit be655c3736b3
• Kernel Commit cb2c9c4bb132

Workarounds

• Enable KASAN in test environments to detect potential exploitation attempts, though this has performance overhead
• Limit audio workloads on affected systems until patches are applied to reduce the attack surface
• Consider using alternative DMA drivers if available for your hardware platform
• Implement kernel module blocklisting for tegra-adma if audio functionality is not required

# Check if tegra-adma driver is loaded
lsmod | grep tegra_adma

# Temporarily blocklist the driver if not required (add to /etc/modprobe.d/blocklist-tegra-adma.conf)
echo "blacklist tegra_adma" | sudo tee /etc/modprobe.d/blocklist-tegra-adma.conf

# Verify kernel version and check for available updates
uname -r
apt list --upgradable 2>/dev/null | grep linux-image