Medium 5.5Published Jan 31, 2026

CVE-2025-71188dmaengine: lpc18xx-dmamux: fix device leak on route allocation

Updated under an hour ago (Oct 28, 2026, 9:50 AM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: dmaengine: lpc18xx-dmamux: fix device leak on route allocation Make sure to drop the reference taken when looking up the DMA mux platform device during route allocation. Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Jun 2, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from e5f4ae84be7421010780984bdc121eac15997327 before 3d396ebfb3049a2b5fac51d2c967db5114b685e8; from e5f4ae84be7421010780984bdc121eac15997327 before 499ddae78c4baa9b94df76b2d2eb6b150d15377f; from e5f4ae84be7421010780984bdc121eac15997327 before adef147a8d8c3d767abf88ad2c381ffab2993086; from e5f4ae84be7421010780984bdc121eac15997327 before 9fba97baa520c9446df51a64708daf27c5a7ed32; from e5f4ae84be7421010780984bdc121eac15997327 before 992eb8055a6e5dbb808672d20d68e60d5a89b12b; from e5f4ae84be7421010780984bdc121eac15997327 before 1e47d80f6720f0224efd19bcf081d39637569c10; from e5f4ae84be7421010780984bdc121eac15997327 before d4d63059dee7e7cae0c4d9a532ed558bc90efb55	CNA record
Siemens RUGGEDCOM RST2428P siemens:ruggedcom_rst2428p (from the name)	before V4.0	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.3.1 before 5.10.249; from 5.11 before 5.15.199; from 5.16 before 6.1.162; from 6.2 before 6.6.122; from 6.7 before 6.12.67; from 6.13 before 6.18.7; 4.3; 6.19; and 7 more ranges	NVD

References

References

https://git.kernel.org/stable/c/3d396ebfb3049a2b5fac51d2c967db5114b685e8	patch
https://git.kernel.org/stable/c/499ddae78c4baa9b94df76b2d2eb6b150d15377f	patch
https://git.kernel.org/stable/c/adef147a8d8c3d767abf88ad2c381ffab2993086	patch
https://git.kernel.org/stable/c/9fba97baa520c9446df51a64708daf27c5a7ed32	patch
https://git.kernel.org/stable/c/992eb8055a6e5dbb808672d20d68e60d5a89b12b	patch
https://git.kernel.org/stable/c/1e47d80f6720f0224efd19bcf081d39637569c10	patch
https://git.kernel.org/stable/c/d4d63059dee7e7cae0c4d9a532ed558bc90efb55	patch
https://cert-portal.siemens.com/productcert/html/ssa-253495.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.