Medium 5.5Published May 6, 2026

CVE-2025-71287memory: mtk-smi: fix device leak on larb probe

Updated under an hour ago (Oct 27, 2026, 2:30 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: memory: mtk-smi: fix device leak on larb probe Make sure to drop the reference taken when looking up the SMI device during larb probe on late probe failure (e.g. probe deferral) and on driver unbind.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from cc8bbe1a83128ad06457e4dc69907c4f9a6fc1a7 before 04057b86fdac3d4847913a97dc6552c0bff9b85e; from cc8bbe1a83128ad06457e4dc69907c4f9a6fc1a7 before 357e16a7fc9c1fef2ea37dce9bb6b9bcb1d1687d; from cc8bbe1a83128ad06457e4dc69907c4f9a6fc1a7 before b9eccd59697f7e1cb9a714501d9af826e7f7e073; from cc8bbe1a83128ad06457e4dc69907c4f9a6fc1a7 before 1f23a48ff2b8ab47e514f7c84a4b1dbf9b848168; from cc8bbe1a83128ad06457e4dc69907c4f9a6fc1a7 before f69535b77fa0518ad39870c00dd2995439ed5c34; from cc8bbe1a83128ad06457e4dc69907c4f9a6fc1a7 before 1288bb394d464975cea18f69940f206e235e0fe7; from cc8bbe1a83128ad06457e4dc69907c4f9a6fc1a7 before 9dae65913b32d05dbc8ff4b8a6bf04a0e49a8eb6	CNA record
linux linux_kernel linux:linux_kernel	from 4.6 before 5.15.203; from 5.16 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.77; from 6.13 before 6.18.17; from 6.19 before 6.19.6	NVD

References

References

https://git.kernel.org/stable/c/04057b86fdac3d4847913a97dc6552c0bff9b85e	patch
https://git.kernel.org/stable/c/357e16a7fc9c1fef2ea37dce9bb6b9bcb1d1687d	patch
https://git.kernel.org/stable/c/b9eccd59697f7e1cb9a714501d9af826e7f7e073	patch
https://git.kernel.org/stable/c/1f23a48ff2b8ab47e514f7c84a4b1dbf9b848168	patch
https://git.kernel.org/stable/c/f69535b77fa0518ad39870c00dd2995439ed5c34	patch
https://git.kernel.org/stable/c/1288bb394d464975cea18f69940f206e235e0fe7	patch
https://git.kernel.org/stable/c/9dae65913b32d05dbc8ff4b8a6bf04a0e49a8eb6	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.