CVE-2025-71158 (GCVE-0-2025-71158)

Vulnerability from cvelistv5 – Published: 2026-01-23 15:23 – Updated: 2026-08-05 12:12
VLAI
Title
gpio: mpsse: ensure worker is torn down
Summary
In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: ensure worker is torn down When an IRQ worker is running, unplugging the device would cause a crash. The sealevel hardware this driver was written for was not hotpluggable, so I never realized it. This change uses a spinlock to protect a list of workers, which it tears down on disconnect.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: c46a74ff05c0ac76ba11ef21c930c3b447abf31a , < 472d900c8bcac301ae0e40fdca7db799bd989ff5 (git)
Affected: c46a74ff05c0ac76ba11ef21c930c3b447abf31a , < 179ef1127d7a4f09f0e741fa9f30b8a8e7886271 (git)
Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.18.6 , ≤ 6.18.* (semver)
Unaffected: 6.19 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpio-mpsse.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "472d900c8bcac301ae0e40fdca7db799bd989ff5",
              "status": "affected",
              "version": "c46a74ff05c0ac76ba11ef21c930c3b447abf31a",
              "versionType": "git"
            },
            {
              "lessThan": "179ef1127d7a4f09f0e741fa9f30b8a8e7886271",
              "status": "affected",
              "version": "c46a74ff05c0ac76ba11ef21c930c3b447abf31a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpio/gpio-mpsse.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.6",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: mpsse: ensure worker is torn down\n\nWhen an IRQ worker is running, unplugging the device would cause a\ncrash. The sealevel hardware this driver was written for was not\nhotpluggable, so I never realized it.\n\nThis change uses a spinlock to protect a list of workers, which\nit tears down on disconnect."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - A local caller with write access to the USB device node can issue USBDEVFS_IOCTL containing USBDEVFS_DISCONNECT, which synchronously reaches gpio_mpsse_disconnect(); physical unplugging is an additional path.\nAC:L - The attacker can arm edge detection through GPIO_V2_GET_LINE_IOCTL and then initiate software disconnect, controlling both sides of the race. The continuously running polling worker makes repeated triggering practical.\nPR:L - Neither the GPIO request nor USBFS disconnect path performs a capable() or ns_capable() check; access is governed only by device-node DAC/LSM policy, so a basic user granted device access suffices.\nUI:N - No victim action is required after the attacker arms the worker and disconnects the interface, and deployed controller services may already keep GPIO edge IRQs continuously active.\nS:U - The vulnerable worker and affected resources are within the same host-kernel security authority, with no VM, IOMMU, or other security-boundary crossing.\nC:H - The worker can continue dereferencing a devm-freed mpsse_priv containing kernel pointers and synchronization objects, allowing attacker-influenced reclaimed contents to support kernel-memory disclosure.\nI:H - The use-after-free performs operations through reclaimed pointers and mutexes, while the reclaimed gpio.ngpio value controls loops over fixed 16-entry stack arrays, making arbitrary corruption and control-flow hijacking defensible.\nA:H - The documented outcome is a kernel crash on disconnect, reachable through immediate NULL dereferences or subsequent use-after-free accesses by the unterminated worker."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:12:24.125Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/472d900c8bcac301ae0e40fdca7db799bd989ff5"
        },
        {
          "url": "https://git.kernel.org/stable/c/179ef1127d7a4f09f0e741fa9f30b8a8e7886271"
        }
      ],
      "title": "gpio: mpsse: ensure worker is torn down",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-71158",
    "datePublished": "2026-01-23T15:23:57.016Z",
    "dateReserved": "2026-01-13T15:30:19.665Z",
    "dateUpdated": "2026-08-05T12:12:24.125Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-71158",
      "date": "2026-08-05",
      "epss": "0.00144",
      "percentile": "0.04168"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-71158\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-01-23T16:15:52.690\",\"lastModified\":\"2026-07-30T06:24:54.880\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngpio: mpsse: ensure worker is torn down\\n\\nWhen an IRQ worker is running, unplugging the device would cause a\\ncrash. The sealevel hardware this driver was written for was not\\nhotpluggable, so I never realized it.\\n\\nThis change uses a spinlock to protect a list of workers, which\\nit tears down on disconnect.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\ngpio: mpsse: asegurar que el worker se desmonte\\n\\nCuando un worker IRQ est\u00e1 en ejecuci\u00f3n, desenchufar el dispositivo causar\u00eda un fallo. El hardware sealevel para el que se escribi\u00f3 este controlador no era hotpluggable, as\u00ed que nunca me di cuenta.\\n\\nEste cambio utiliza un spinlock para proteger una lista de workers, la cual desmonta al desconectar.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpio/gpio-mpsse.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c46a74ff05c0ac76ba11ef21c930c3b447abf31a\",\"lessThan\":\"472d900c8bcac301ae0e40fdca7db799bd989ff5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c46a74ff05c0ac76ba11ef21c930c3b447abf31a\",\"lessThan\":\"179ef1127d7a4f09f0e741fa9f30b8a8e7886271\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpio/gpio-mpsse.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.6\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.6\",\"matchCriteriaId\":\"879529BC-5B4C-4EBE-BF1D-1A31404A8B2E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/179ef1127d7a4f09f0e741fa9f30b8a8e7886271\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/472d900c8bcac301ae0e40fdca7db799bd989ff5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T11:39:43+00:00",
      "cve": "CVE-2025-71158",
      "id": "CVE-2025-71158",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: gpio: mpsse: ensure worker is torn down",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-71158.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-05-20T02:34:47Z",
      "cve": "CVE-2025-71158",
      "id": "CVE-2025-71158",
      "initial_release_date": "2026-01-25T00:24:19Z",
      "product_status:known_not_affected": "263",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-71158",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-71158.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.