CVE-2025-71081ASoC: stm32: sai: fix OF node leak on probe
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ASoC: stm32: sai: fix OF node leak on probe The reference taken to the sync provider OF node when probing the platform device is currently only dropped if the set_sync() callback fails during DAI probe. Make sure to drop the reference on platform probe failures (e.g. probe deferral) and on driver unbind. This also avoids a potential use-after-free in case the DAI is ever reprobed without first rebinding the platform driver.
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- May 11, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 5914d285f6b782892a91d6621723fdc41a775b15 builds before 7daa50a2157e41c964b745ab1dc378b5b3b626d1; from 5914d285f6b782892a91d6621723fdc41a775b15 before acda653169e180b1d860dbb6bc5aceb105858394; 5914d285f6b782892a91d6621723fdc41a775b15 builds before 4054a3597d047f3fe87864ef87f399b5d523e6c0; from 5914d285f6b782892a91d6621723fdc41a775b15 before bae74771fc5d3b2a9cf6f5aa64596083d032c4a3; 5914d285f6b782892a91d6621723fdc41a775b15 builds before 3752afcc6d80d5525e236e329895ba2cb93bcb26; from 5914d285f6b782892a91d6621723fdc41a775b15 before 23261f0de09427367e99f39f588e31e2856a690e | CNA record |
linux linux_kernel linux:linux_kernel | from 4.15.1 before 5.15.198; from 5.16 before 6.1.160; from 6.2 before 6.6.120; from 6.7 before 6.12.64; from 6.13 before 6.18.4; 4.15; 6.19; 6.19; and 6 more ranges | NVD |
References
- https://git.kernel.org/stable/c/7daa50a2157e41c964b745ab1dc378b5b3b626d1patch
- https://git.kernel.org/stable/c/acda653169e180b1d860dbb6bc5aceb105858394patch
- https://git.kernel.org/stable/c/4054a3597d047f3fe87864ef87f399b5d523e6c0patch
- https://git.kernel.org/stable/c/bae74771fc5d3b2a9cf6f5aa64596083d032c4a3patch
- https://git.kernel.org/stable/c/3752afcc6d80d5525e236e329895ba2cb93bcb26patch
- https://git.kernel.org/stable/c/23261f0de09427367e99f39f588e31e2856a690epatch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.