CVE-2025-71185: Linux Kernel DMA Crossbar Leak Vulnerability

CVE-2025-71185 Overview

A memory leak vulnerability has been identified in the Linux kernel's DMA engine subsystem, specifically affecting the Texas Instruments DMA crossbar driver. The vulnerability occurs during AM335x route allocation when a device reference is obtained but not properly released when looking up the crossbar platform device.

Critical Impact

This memory leak vulnerability can lead to gradual resource exhaustion on affected AM335x-based systems, potentially causing system instability or denial of service conditions over extended periods of operation.

Affected Products

• Linux kernel (versions with affected dma-crossbar driver)
• Texas Instruments AM335x-based embedded systems
• Devices utilizing the TI DMA crossbar subsystem

Discovery Timeline

• 2026-01-31 - CVE CVE-2025-71185 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2025-71185

Vulnerability Analysis

This vulnerability resides in the dmaengine: ti: dma-crossbar component of the Linux kernel. The issue is a classic device reference leak where the kernel fails to properly release a reference count obtained during platform device lookup operations.

When the DMA crossbar driver performs route allocation for AM335x devices, it looks up the crossbar platform device using kernel APIs that increment a reference counter. Under normal circumstances, this reference should be dropped (decremented) when no longer needed. However, the vulnerable code path fails to call the appropriate reference release function, causing the reference count to remain elevated indefinitely.

Over time, as route allocations occur repeatedly, unreleased device references accumulate, leading to kernel memory consumption that cannot be reclaimed. This represents a resource exhaustion condition that affects long-running embedded systems built on the AM335x platform.

Root Cause

The root cause is an improper resource management issue in the DMA crossbar driver's AM335x route allocation code path. When the driver uses of_find_device_by_node() or similar functions to locate the crossbar platform device, these functions take a reference on the device structure. The original code neglected to call put_device() or the equivalent reference-dropping function after the device lookup was complete, resulting in a persistent reference leak.

Attack Vector

This vulnerability has a local attack vector since it requires access to the affected system to trigger route allocation operations that cause the memory leak. While not directly exploitable for code execution, an attacker with local access could potentially:

• Trigger repeated DMA route allocations to accelerate memory exhaustion
• Cause denial of service through resource depletion on embedded systems with limited memory
• Exploit the memory leak in conjunction with other vulnerabilities

The vulnerability is primarily a reliability and availability concern rather than a direct security exploit vector. Embedded systems and IoT devices running on AM335x platforms are the primary targets, as these systems often run continuously for extended periods where memory leaks become more impactful.

Detection Methods for CVE-2025-71185

Indicators of Compromise

• Gradual increase in kernel memory consumption over time on AM335x-based systems
• Elevated device reference counts in /sys/kernel/debug/ related to DMA subsystem
• System logs showing memory allocation failures or warnings
• Unexpected system slowdowns on long-running embedded devices

Detection Strategies

• Monitor kernel memory usage trends using tools like slabtop or /proc/meminfo
• Implement periodic kernel memory auditing on affected embedded systems
• Check for the presence of patched kernel versions using uname -r
• Review system logs for DMA-related errors or memory pressure indicators

Monitoring Recommendations

• Deploy memory monitoring solutions on AM335x-based embedded systems
• Set up alerts for abnormal kernel memory growth patterns
• Periodically restart affected systems as a mitigation measure until patching is complete
• Monitor system uptime correlation with memory consumption increases

How to Mitigate CVE-2025-71185

Immediate Actions Required

• Update the Linux kernel to a patched version containing the fix
• Review all AM335x-based deployments for exposure to this vulnerability
• Implement scheduled restarts for critical systems until patches can be applied
• Monitor affected systems for signs of memory exhaustion

Patch Information

The Linux kernel development team has released patches to address this vulnerability. The fix ensures that device references taken during crossbar platform device lookups are properly dropped using the appropriate reference release functions.

Patches are available through the following kernel git commits:

• Kernel Git Commit 30352277
• Kernel Git Commit 4fc17b1c
• Kernel Git Commit 6fdf168f
• Kernel Git Commit f810132e

Workarounds

• Schedule periodic system reboots to clear accumulated leaked references
• Limit DMA route allocation frequency where application design permits
• Monitor system memory and trigger proactive restarts before exhaustion
• Consider disabling unused DMA crossbar functionality if not required for operation

# Check current kernel version and DMA crossbar module status
uname -r
lsmod | grep dma
cat /proc/meminfo | grep -E "(MemFree|Slab|SReclaimable)"