Skip to main content

Linux Kernel CVE-2025-71272

| EUVDEUVD-2025-209672 MEDIUM
Memory Leak (CWE-401)
2026-05-06 Linux GHSA-hgp5-3fhg-p5cf
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
May 13, 2026 - 00:00 vuln.today
CVSS changed
May 12, 2026 - 21:37 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:02 EUVD
CVE Published
May 06, 2026 - 11:27 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

most: core: fix resource leak in most_register_interface error paths

The function most_register_interface() did not correctly release resources if it failed early (before registering the device). In these cases, it returned an error code immediately, leaking the memory allocated for the interface.

Fix this by initializing the device early via device_initialize() and calling put_device() on all error paths.

The most_register_interface() is expected to call put_device() on error which frees the resources allocated in the caller. The put_device() either calls release_mdev() or dim2_release(), depending on the caller.

Switch to using device_add() instead of device_register() to handle the split initialization.

AnalysisAI

Resource leak in Linux kernel's most_register_interface() function allows local attackers with low privileges to cause denial of service through memory exhaustion. The vulnerability occurs when most_register_interface() fails during early initialization stages, returning error codes without properly releasing allocated device resources via put_device(). Patch versions 6.12.75, 6.18.16, 6.19.6, and 7.0 address this issue.

Technical ContextAI

The vulnerability exists in the Linux kernel's MOST (Media Oriented Systems Transport) subsystem core module, specifically in the most_register_interface() function responsible for device registration. The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime), a resource management flaw where allocated memory for interface structures is not freed on error paths. The function uses device_register() which performs atomic initialization and registration; the fix requires switching to device_initialize() followed by device_add() to enable proper split-phase handling, allowing put_device() calls to correctly release resources through either release_mdev() or dim2_release() cleanup callbacks depending on the caller context.

RemediationAI

Update Linux kernel to patched versions: 6.12.75 or later, 6.18.16 or later, 6.19.6 or later, or 7.0 or later. Apply the upstream fix by pulling commits a49028a796d7b94f8e3ab9bd34b18f36be235459, af0b99b2214a10554adb5b868240d23af6e64e71, 2f483f3817fb0e4209ac5de928778b1da0cc8574, or 1f4c9d8a1021281750c6cda126d6f8a40cc24e71 from git.kernel.org/stable depending on your kernel version. For systems unable to immediately upgrade, monitor kernel logs for most_register_interface() errors and restrict access to MOST device registration APIs if not in use; note that disabling MOST subsystem support entirely may impact automotive/industrial functionality. Verify your kernel version with 'uname -r' and cross-reference against patched releases before deployment.

Same weakness CWE-401 – Memory Leak

View all
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1
CVE-2023-23145 HIGH POC
7.8
CVE-2022-35858 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2025-71272 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy