CVE-2025-71188: Linux Kernel Device Leak Vulnerability

CVE-2025-71188 Overview

A memory leak vulnerability has been identified in the Linux kernel's DMA engine subsystem, specifically in the lpc18xx-dmamux driver. The vulnerability occurs during route allocation when the driver fails to properly release a device reference obtained while looking up the DMA mux platform device. This reference counting error can lead to resource exhaustion over time as device references accumulate without being properly freed.

Critical Impact

Prolonged exploitation or repeated triggering of this vulnerability may result in memory exhaustion and system instability on affected embedded systems using the LPC18xx DMA multiplexer.

Affected Products

• Linux kernel with lpc18xx-dmamux DMA engine driver
• Embedded systems using NXP LPC18xx series microcontrollers
• Devices utilizing the DMA multiplexer subsystem on LPC18xx platforms

Discovery Timeline

• 2026-01-31 - CVE CVE-2025-71188 published to NVD
• 2026-02-03 - Last updated in NVD database

Technical Details for CVE-2025-71188

Vulnerability Analysis

The vulnerability resides in the lpc18xx-dmamux driver within the Linux kernel's DMA engine subsystem. During DMA route allocation operations, the driver performs a lookup for the DMA mux platform device using kernel device reference APIs. Upon successful lookup, the kernel increments the device's reference count. However, the driver code path fails to call the corresponding put_device() function to decrement this reference count when the operation completes or fails.

As noted in the kernel patch description, holding a reference to a device does not prevent its driver data from being deallocated, making the retained reference both unnecessary and harmful. Each route allocation that triggers this code path increments the reference counter without a corresponding decrement, leading to a gradual memory leak.

Root Cause

The root cause is improper reference counting management in the lpc18xx-dmamux driver. When the driver looks up the DMA mux platform device during route allocation using functions like of_find_device_by_node() or similar device lookup APIs, a reference to the device structure is taken. The driver neglects to release this reference by calling put_device() or equivalent cleanup functions, violating Linux kernel reference counting conventions.

Attack Vector

This vulnerability requires local access to the system and the ability to trigger DMA route allocation operations. While not directly exploitable for code execution, repeated triggering of the vulnerable code path could lead to:

1. Gradual memory consumption through accumulated device references
2. System performance degradation as kernel memory becomes fragmented
3. Potential denial of service on resource-constrained embedded systems

The vulnerability affects the kernel's internal resource management rather than providing direct attacker control over code execution.

Detection Methods for CVE-2025-71188

Indicators of Compromise

• Increasing kernel memory usage over time on LPC18xx-based systems
• Elevated reference counts on DMA mux platform device structures
• Kernel warning messages related to device reference counting anomalies
• System slowdown or instability after prolonged operation with DMA activity

Detection Strategies

• Monitor kernel memory statistics using /proc/meminfo for unexplained slab memory growth
• Use kernel debugging tools such as kmemleak to identify unreleased device references
• Enable kernel reference tracking debugging options (CONFIG_DEBUG_KOBJECT_RELEASE) to detect improper reference handling
• Review system logs for DMA subsystem warnings or errors

Monitoring Recommendations

• Implement periodic system health checks on embedded LPC18xx platforms
• Configure alerting thresholds for kernel memory consumption metrics
• Monitor DMA engine subsystem activity through kernel tracing (ftrace)
• Establish baseline memory profiles for normal DMA operation patterns

How to Mitigate CVE-2025-71188

Immediate Actions Required

• Update the Linux kernel to a patched version containing the reference leak fix
• Review system deployment schedules to plan kernel update maintenance windows
• Monitor affected systems for memory exhaustion symptoms until patches are applied
• Consider reducing DMA route allocation frequency on critical systems as a temporary measure

Patch Information

The Linux kernel maintainers have released patches to address this vulnerability. The fix ensures that the device reference taken during DMA mux platform device lookup is properly released. Multiple patch commits have been made available for different kernel stable branches:

• Kernel Git Commit 1e47d80
• Kernel Git Commit 992eb80
• Kernel Git Commit 9fba97b
• Kernel Git Commit d4d6305

Workarounds

• Limit DMA multiplexer usage on affected systems where kernel updates cannot be immediately applied
• Implement scheduled system reboots to clear accumulated memory leaks on long-running embedded devices
• Disable the lpc18xx-dmamux driver if DMA multiplexing functionality is not required for the deployment
• Consider alternative DMA routing configurations that bypass the affected code path

# Check if the affected module is loaded
lsmod | grep lpc18xx

# View current kernel memory statistics
cat /proc/meminfo | grep -E "Slab|SReclaimable|SUnreclaim"

# Monitor DMA engine status
ls -la /sys/class/dma/