Skip to main content

Linux Kernel EUVDEUVD-2025-209672

| CVE-2025-71272 MEDIUM
Memory Leak (CWE-401)
2026-05-06 Linux GHSA-hgp5-3fhg-p5cf
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local system access
  2. Delivery
    Repeatedly trigger MOST device registration failures
  3. Exploit
    Accumulate memory leaks in kernel pools
  4. Execution
    Exhaust available kernel memory
  5. Impact
    Trigger denial of service

Vulnerability Assessment

Weakness
CWE
CWE-401
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
Exploitation Conditions

Attacker requires local system access and low-level user privileges (PR:L in CVSS vector). Exploitation requires the ability to repeatedly invoke most_register_interface() failures, which may occur through MOST device driver initialization calls or user-space interfaces exposed by the MOST subsystem. Non-default configurations or specific MOST hardware drivers must be present and active; systems without MOST subsystem support compiled into the kernel or with MOST devices disabled are unaffected. No special user interaction required beyond triggering registration calls.
Impact

This is a low-priority denial-of-service vulnerability despite moderate CVSS score. EPSS score of 0.02% (5th percentile) indicates minimal real-world exploitation probability, suggesting this is not an attractive attack target compared to remote or privilege-escalation flaws. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) confirms local-only access requirement with low privilege threshold, limiting attack surface to authenticated system users. No active exploitation (KEV status not listed) or public exploit code reported. The vulnerability requires repeated calls to most_register_interface() failure paths to accumulate memory leaks sufficient for denial of service-a realistic but not trivial exploitation scenario. Attack complexity is low due to straightforward triggering mechanism, but privilege and local-access requirements significantly reduce real-world risk. This is a maintenance issue rather than an active security threat.
Exploit ScenarioDerived

A local user with system access repeatedly triggers most_register_interface() failures by attempting to register malformed MOST interface devices or exhausting prerequisites, causing the function to return early without releasing device memory. After multiple failed registration attempts, accumulated memory leaks exhaust available kernel memory pools, triggering out-of-memory conditions that degrade system performance or force a denial-of-service condition.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 13, 2026

Resource leak in Linux kernel's most_register_interface() function allows local attackers with low privileges to cause denial of service through memory exhaustion. The vulnerability occurs when most_register_interface() fails during early initialization stages, returning error codes without properly releasing allocated device resources via put_device(). Patch versions 6.12.75, 6.18.16, 6.19.6, and 7.0 address this issue.

RemediationAI

Update Linux kernel to patched versions: 6.12.75 or later, 6.18.16 or later, 6.19.6 or later, or 7.0 or later. Apply the upstream fix by pulling commits a49028a796d7b94f8e3ab9bd34b18f36be235459, af0b99b2214a10554adb5b868240d23af6e64e71, 2f483f3817fb0e4209ac5de928778b1da0cc8574, or 1f4c9d8a1021281750c6cda126d6f8a40cc24e71 from git.kernel.org/stable depending on your kernel version. For systems unable to immediately upgrade, monitor kernel logs for most_register_interface() errors and restrict access to MOST device registration APIs if not in use; note that disabling MOST subsystem support entirely may impact automotive/industrial functionality. Verify your kernel version with 'uname -r' and cross-reference against patched releases before deployment.

Affected VersionsENISA

Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <1f4c9d8a1021281750c6cda126d6f8a40cc24e71
Linux patch: 6.18.16
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <a49028a796d7b94f8e3ab9bd34b18f36be235459
Linux patch: 7.0
Linux patch: 6.12.75
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <2f483f3817fb0e4209ac5de928778b1da0cc8574
Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <af0b99b2214a10554adb5b868240d23af6e64e71
Linux patch: 6.19.6

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability exists in the Linux kernel's MOST (Media Oriented Systems Transport) subsystem core module, specifically in the most_register_interface() function responsible for device registration. The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime), a resource management flaw where allocated memory for interface structures is not freed on error paths. The function uses device_register() which performs atomic initialization and registration; the fix requires switching to device_initialize() followed by device_add() to enable proper split-phase handling, allowing put_device() calls to correctly release resources through either release_mdev() or dim2_release() cleanup callbacks depending on the caller context.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE MEDIUM

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
CVSS changed
May 12, 2026 - 21:37 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:02 EUVD
CVE Published
May 06, 2026 - 11:27 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

most: core: fix resource leak in most_register_interface error paths

The function most_register_interface() did not correctly release resources if it failed early (before registering the device). In these cases, it returned an error code immediately, leaking the memory allocated for the interface.

Fix this by initializing the device early via device_initialize() and calling put_device() on all error paths.

The most_register_interface() is expected to call put_device() on error which frees the resources allocated in the caller. The put_device() either calls release_mdev() or dim2_release(), depending on the caller.

Switch to using device_add() instead of device_register() to handle the split initialization.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2025-25469 HIGH POC
8.8
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-71272 ADVISORY https://ubuntu.com/security/notices/USN-8492-1 ADVISORY https://vuldb.com/vuln/361381 REF https://git.kernel.org/stable/c/1f4c9d8a1021281750c6cda126d6f8a40cc24e71 REF https://git.kernel.org/stable/c/2f483f3817fb0e4209ac5de928778b1da0cc8574 REF https://git.kernel.org/stable/c/82f42a13e3d7a07a950ee4fa2d4c74843a3e7ace REF https://git.kernel.org/stable/c/a49028a796d7b94f8e3ab9bd34b18f36be235459 REF https://git.kernel.org/stable/c/af0b99b2214a10554adb5b868240d23af6e64e71

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy