CVE-2025-71272

{"id": "CVE-2025-71272", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "723de0f9171eeb49a3ae98cae82ebbbb992b3a7c", "lessThan": "82f42a13e3d7a07a950ee4fa2d4c74843a3e7ace", "versionType": "git"}, {"status": "affected", "version": "723de0f9171eeb49a3ae98cae82ebbbb992b3a7c", "lessThan": "a49028a796d7b94f8e3ab9bd34b18f36be235459", "versionType": "git"}, {"status": "affected", "version": "723de0f9171eeb49a3ae98cae82ebbbb992b3a7c", "lessThan": "af0b99b2214a10554adb5b868240d23af6e64e71", "versionType": "git"}, {"status": "affected", "version": "723de0f9171eeb49a3ae98cae82ebbbb992b3a7c", "lessThan": "2f483f3817fb0e4209ac5de928778b1da0cc8574", "versionType": "git"}, {"status": "affected", "version": "723de0f9171eeb49a3ae98cae82ebbbb992b3a7c", "lessThan": "1f4c9d8a1021281750c6cda126d6f8a40cc24e71", "versionType": "git"}], "programFiles": ["drivers/most/core.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.6"}, {"status": "unaffected", "version": "0", "lessThan": "5.6", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.75", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.16", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.6", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/most/core.c"], "defaultStatus": "affected"}]}], "published": "2026-05-06T12:16:27.213", "references": [{"url": "https://git.kernel.org/stable/c/1f4c9d8a1021281750c6cda126d6f8a40cc24e71", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/2f483f3817fb0e4209ac5de928778b1da0cc8574", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/82f42a13e3d7a07a950ee4fa2d4c74843a3e7ace", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a49028a796d7b94f8e3ab9bd34b18f36be235459", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/af0b99b2214a10554adb5b868240d23af6e64e71", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-401"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmost: core: fix resource leak in most_register_interface error paths\n\nThe function most_register_interface() did not correctly release resources\nif it failed early (before registering the device). In these cases, it\nreturned an error code immediately, leaking the memory allocated for the\ninterface.\n\nFix this by initializing the device early via device_initialize() and\ncalling put_device() on all error paths.\n\nThe most_register_interface() is expected to call put_device() on\nerror which frees the resources allocated in the caller. The\nput_device() either calls release_mdev() or dim2_release(),\ndepending on the caller.\n\nSwitch to using device_add() instead of device_register() to handle\nthe split initialization."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmost: core: corregir fuga de recursos en las rutas de error de most_register_interface\n\nLa funci\u00f3n most_register_interface() no liberaba correctamente los recursos si fallaba prematuramente (antes de registrar el dispositivo). En estos casos, devolv\u00eda un c\u00f3digo de error inmediatamente, fugando la memoria asignada para la interfaz.\n\nSolucionar esto mediante la inicializaci\u00f3n temprana del dispositivo a trav\u00e9s de device_initialize() y llamando a put_device() en todas las rutas de error.\n\nSe espera que most_register_interface() llame a put_device() en caso de error, lo que libera los recursos asignados en el llamador. put_device() llama a release_mdev() o a dim2_release(), dependiendo del llamador.\n\nCambiar a usar device_add() en lugar de device_register() para manejar la inicializaci\u00f3n dividida."}], "lastModified": "2026-10-21T13:18:25.973", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "168F1117-B247-4CC5-B097-132EE9E96FDD", "versionEndExcluding": "6.12.75", "versionStartIncluding": "5.6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B", "versionEndExcluding": "6.18.16", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67", "versionEndExcluding": "6.19.6", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}