Skip to content
Heist/ feed
Back to feed
UnratedFix available

iommu/mediatek: fix use-after-free on probe deferral

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: fix use-after-free on probe deferral The driver is dropping the references taken to the larb devices during probe after successful lookup as well as on errors. This can potentially lead to a use-after-free in case a larb device has not yet been bound to its driver so that the iommu driver probe defers. Fix this by keeping the references as expected while the iommu driver is bound.

Products
Kernel
Affected versions
Not specified
Fixed versions
6.1.160, 6.12.64, 6.18.3, 6.6.120
CVEs
CVE-2025-71071
Confirmed fixed CVEs
Not specified
Updated in this feed
6 Nov 2026, 17:57 UTC · Revision 1

Source evidence

iommu/mediatek: fix use-after-free on probe deferral

core-osv · Original source

Published 13 Jan 2026, 15:31 UTC

In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: fix use-after-free on probe deferral The driver is dropping the references taken to the larb devices during probe after successful lookup as well as on errors. This can potentially lead to a use-after-free in case a larb device has not yet been bound to its driver so that the iommu driver probe defers. Fix this by keeping the references as expected while the iommu driver is bound.

osv:CVE-2025-71071

Kernel

Fixed versions: 6.1.160, 6.6.120, 6.12.64, 6.18.3

Complete source record
{
  "id": "2d695c2841676a8f773e0c70736d0a4c583df88409b4700fa59bf202dce76f20",
  "url": "https://osv.dev/vulnerability/CVE-2025-71071",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "iommu/mediatek: fix use-after-free on probe deferral",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: fix use-after-free on probe deferral The driver is dropping the references taken to the larb devices during probe after successful lookup as well as on errors. This can potentially lead to a use-after-free in case a larb device has not yet been bound to its driver so that the iommu driver probe defers. Fix this by keeping the references as expected while the iommu driver is bound.",
    "evidence": "osv:CVE-2025-71071",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.1.160",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.120",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.64",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.3",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2025-71071",
      "aliases": [
        "CVE-2025-71071"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "8412e5dd24ffc8bc21a00bfaa0b80d4596cdc9da"
                },
                {
                  "fixed": "896ec55da3b90bdb9fc04fedc17ad8c359b2eee5"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "26593928564cf5b576ff05d3cbd958f57c9534bb"
                },
                {
                  "fixed": "5c04217d06a1161aaf36267e9d971ab6f847d5a7"
                },
                {
                  "fixed": "1ef70a0b104ae8011811f60bcfaa55ff49385171"
                },
                {
                  "fixed": "f6c08d3aa441bbc1956e9d65f1cbb89113a5aa8a"
                },
                {
                  "fixed": "de83d4617f9fe059623e97acf7e1e10d209625b5"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "6.1.2"
                },
                {
                  "fixed": "6.1.160"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "6.0.16"
                },
                {
                  "fixed": "6.1"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "51080de72e26771f0ed9d44982974279ccbc92b8"
                }
              ]
            }
          ],
          "versions": [
            "v6.1.159",
            "v6.1.158",
            "v6.1.157",
            "v6.1.156",
            "v6.1.155",
            "v6.1.154",
            "v6.1.153",
            "v6.1.152",
            "v6.1.151",
            "v6.1.150",
            "v6.1.149",
            "v6.1.148",
            "v6.1.147",
            "v6.1.146",
            "v6.1.145",
            "v6.1.144",
            "v6.1.143",
            "v6.1.142",
            "v6.1.141",
            "v6.1.140",
            "v6.1.139",
            "v6.1.138",
            "v6.1.137",
            "v6.1.136",
            "v6.1.135",
            "v6.1.134",
            "v6.1.133",
            "v6.1.132",
            "v6.1.131",
            "v6.1.130",
            "v6.1.129",
            "v6.1.128",
            "v6.1.127",
            "v6.1.126",
            "v6.1.125",
            "v6.1.124",
            "v6.1.123",
            "v6.1.122",
            "v6.1.121",
            "v6.1.120",
            "v6.1.119",
            "v6.1.118",
            "v6.1.117",
            "v6.1.116",
            "v6.1.115",
            "v6.1.114",
            "v6.1.113",
            "v6.1.112",
            "v6.1.111",
            "v6.1.110",
            "v6.1.109",
            "v6.1.108",
            "v6.1.107",
            "v6.1.106",
            "v6.1.105",
            "v6.1.104",
            "v6.1.103",
            "v6.1.102",
            "v6.1.101",
            "v6.1.100",
            "v6.1.99",
            "v6.1.98",
            "v6.1.97",
            "v6.1.96",
            "v6.1.95",
            "v6.1.94",
            "v6.1.93",
            "v6.1.92",
            "v6.1.91",
            "v6.1.90",
            "v6.1.89",
            "v6.1.88",
            "v6.1.87",
            "v6.1.86",
            "v6.1.85",
            "v6.1.84",
            "v6.1.83",
            "v6.1.82",
            "v6.1.81",
            "v6.1.80",
            "v6.1.79",
            "v6.1.78",
            "v6.1.77",
            "v6.1.76",
            "v6.1.75",
            "v6.1.74",
            "v6.1.73",
            "v6.1.72",
            "v6.1.71",
            "v6.1.70",
            "v6.1.69",
            "v6.1.68",
            "v6.1.67",
            "v6.1.66",
            "v6.1.65",
            "v6.1.64",
            "v6.1.63",
            "v6.1.62",
            "v6.1.61",
            "v6.1.60",
            "v6.1.59",
            "v6.1.58",
            "v6.1.57",
            "v6.1.56",
            "v6.1.55",
            "v6.1.54",
            "v6.1.53",
            "v6.1.52",
            "v6.1.51",
            "v6.1.50",
            "v6.1.49",
            "v6.1.48",
            "v6.1.47",
            "v6.1.46",
            "v6.1.45",
            "v6.1.44",
            "v6.1.43",
            "v6.1.42",
            "v6.1.41",
            "v6.1.40",
            "v6.1.39",
            "v6.1.38",
            "v6.1.37",
            "v6.1.36",
            "v6.1.35",
            "v6.1.34",
            "v6.1.33",
            "v6.1.32",
            "v6.1.31",
            "v6.1.30",
            "v6.1.29",
            "v6.1.28",
            "v6.1.27",
            "v6.1.26",
            "v6.1.25",
            "v6.1.24",
            "v6.1.23",
            "v6.1.22",
            "v6.1.21",
            "v6.1.20",
            "v6.1.19",
            "v6.1.18",
            "v6.1.17",
            "v6.1.16",
            "v6.1.15",
            "v6.1.14",
            "v6.1.13",
            "v6.1.12",
            "v6.1.11",
            "v6.1.10",
            "v6.1.9",
            "v6.1.8",
            "v6.1.7",
            "v6.1.6",
            "v6.1.5",
            "v6.1.4",
            "v6.1.3",
            "v6.1.2",
            "v6.0.19",
            "v6.0.18",
            "v6.0.17",
            "v6.0.16"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71071.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "6.1.160"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.120"
                },
                {
                  "fixed": "6.12.64"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.18.3"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-71071.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:48.006709295Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/1ef70a0b104ae8011811f60bcfaa55ff49385171",
        "https://git.kernel.org/stable/c/5c04217d06a1161aaf36267e9d971ab6f847d5a7",
        "https://git.kernel.org/stable/c/896ec55da3b90bdb9fc04fedc17ad8c359b2eee5",
        "https://git.kernel.org/stable/c/de83d4617f9fe059623e97acf7e1e10d209625b5",
        "https://git.kernel.org/stable/c/f6c08d3aa441bbc1956e9d65f1cbb89113a5aa8a",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71071.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-71071",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/71xxx/CVE-2025-71071.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-71071",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 515835,
  "published_at": "2026-01-13T15:31:25.4+00:00"
}