CVE-2025-71071

Description

In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: fix use-after-free on probe deferral The driver is dropping the references taken to the larb devices during probe after successful lookup as well as on errors. This can potentially lead to a use-after-free in case a larb device has not yet been bound to its driver so that the iommu driver probe defers. Fix this by keeping the references as expected while the iommu driver is bound.

CVSS Details

CVSS Score

7.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel iommu/mediatek (affected versions prior to fix commits)

Fix commits: 1ef70a0b104ae8011811f60bcfaa55ff49385171

Fix commits: 5c04217d06a1161aaf36267e9d971ab6f847d5a7

Fix commits: 896ec55da3b90bdb9fc04fedc17ad8c359b2eee5

Fix commits: de83d4617f9fe059623e97acf7e1e10d209625b5

Fix commits: f6c08d3aa441bbc1956e9d65f1cbb89113a5aa8a

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// PoC concept for CVE-2025-71071
// This vulnerability requires specific MediaTek hardware and kernel configuration

#include <linux/module.h>
#include <linux/platform_device.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Security Researcher");
MODULE_DESCRIPTION("CVE-2025-71071 PoC Trigger");

// Trigger conditions:
// 1. MediaTek IOMMU hardware present
// 2. larb device not yet bound to driver
// 3. Trigger IOMMU probe deferral
// 4. Access freed larb device reference

static int __init cve_2025_71071_init(void)
{
    // Simulate probe deferral scenario
    // In real exploitation, this requires specific hardware
    // and timing conditions to trigger the UAF
    
    pr_info("CVE-2025-71071: MediaTek IOMMU UAF trigger\n");
    return 0;
}

static void __exit cve_2025_71071_exit(void)
{
    pr_info("CVE-2025-71071: Module unloaded\n");
}

module_init(cve_2025_71071_init);
module_exit(cve_2025_71071_exit);

/*
 * Note: This is a conceptual PoC. Actual exploitation requires:
 * - MediaTek SoC with IOMMU support
 * - Specific device tree configuration
 * - Precise timing to trigger race condition
 * - Kernel debugging to confirm UAF access
 */

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-71071
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-71071
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-71071/
[4] VulDB https://vuldb.com/cve/CVE-2025-71071
[5] https://git.kernel.org/stable/c/1ef70a0b104ae8011811f60bcfaa55ff49385171
[6] https://git.kernel.org/stable/c/5c04217d06a1161aaf36267e9d971ab6f847d5a7
[7] https://git.kernel.org/stable/c/896ec55da3b90bdb9fc04fedc17ad8c359b2eee5
[8] https://git.kernel.org/stable/c/de83d4617f9fe059623e97acf7e1e10d209625b5
[9] https://git.kernel.org/stable/c/f6c08d3aa441bbc1956e9d65f1cbb89113a5aa8a

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-71071", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-01-13T16:16:06.520", "lastModified": "2026-03-25T19:11:30.440", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/mediatek: fix use-after-free on probe deferral\n\nThe driver is dropping the references taken to the larb devices during\nprobe after successful lookup as well as on errors. This can\npotentially lead to a use-after-free in case a larb device has not yet\nbeen bound to its driver so that the iommu driver probe defers.\n\nFix this by keeping the references as expected while the iommu driver is\nbound."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\niommu/mediatek: corregir uso después de liberación en el aplazamiento de la detección\n\nEl controlador está liberando las referencias tomadas a los dispositivos larb durante la detección después de una búsqueda exitosa, así como en caso de errores. Esto puede conducir potencialmente a un uso después de liberación en caso de que un dispositivo larb aún no se haya vinculado a su controlador, de modo que la detección del controlador iommu se aplace.\n\nCorregir esto al mantener las referencias como se espera mientras el controlador iommu está vinculado."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-416"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.16", "versionEndExcluding": "6.1", "matchCriteriaId": "6C7522E3-150F-436D-BBD7-96C7B4B795ED"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.2", "versionEndExcluding": "6.1.160", "matchCriteriaId": "96080E05-6056-48D6-A5E4-A7E6458C9146"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2.1", "versionEndExcluding": "6.6.120", "matchCriteriaId": "528CCBAC-105D-4B7E-B115-EAB6707955CF"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.64", "matchCriteriaId": "32BF4A52-377C-44ED-B5E6-7EA5D896E98B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.3", "matchCriteriaId": "2DC484D8-FB4F-4112-900F-AE333B6FE7A7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.2:-:*:*:*:*:*:*", "matchCriteriaId": "3ADCCCEE-143A-4B48-9B2A-0CB97BD385DE"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*", "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*", "matchCriteriaId": "F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*", "matchCriteriaId": "EB5B7DFC-C36B-45D8-922C-877569FDDF43"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/1ef70a0b104ae8011811f60bcfaa55ff49385171", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/5c04217d06a1161aaf36267e9d971ab6f847d5a7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/896ec55da3b90bdb9fc04fedc17ad8c359b2eee5", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/de83d4617f9fe059623e97acf7e1e10d209625b5", "so ... (truncated)