LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71071: iommu/mediatek: fix use-after-free on probe deferral

In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: fix use-after-free on probe deferral The driver is dropping the references taken to the larb devices during probe after successful lookup as well as on errors. This can potentially lead to a use-after-free in case a larb device has not yet been bound to its driver so that the iommu driver probe defers. Fix this by keeping the references as expected while the iommu driver is bound.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel bug in the MediaTek IOMMU driver. During device startup, the driver could release references too early, creating a possible use-after-free when probing is deferred. Business urgency depends on whether affected Linux kernels run on systems using this driver path.

Executive priority

Treat as a targeted kernel maintenance item unless your fleet includes MediaTek-based Linux devices. There is not enough evidence to justify emergency response, but kernel memory safety bugs should be remediated through normal security update channels.

Technical view

The issue is in iommu/mediatek reference handling for larb devices. The driver dropped references after lookup and on error paths; if a larb device was not yet bound and probe deferral occurred, stale references could lead to use-after-free. Kernel stable commits are listed as fixes.

Likely exposure

Exposure appears limited to Linux systems with affected kernel versions and the MediaTek IOMMU driver path. The source bundle lists Linux as affected, with fixed stable commits referenced. No CPEs, CVSS score, or product-specific deployment details are provided.

Exploitation context

The source bundle does not report active exploitation, and KEV is false. No public exploit status is provided. The condition depends on kernel driver probe deferral involving MediaTek IOMMU larb devices, which suggests exposure is hardware and configuration dependent.

Researcher notes

Key evidence is the kernel resolution text and stable commit references. Severity, CWE, CVSS, CPEs, and exploitation evidence are missing. Analysis should focus on driver reachability, affected branch mapping, and whether downstream kernels have backported the reference-lifetime fix.

Mitigation direction

  • Apply the relevant Linux stable kernel fix for your maintained branch.
  • Check your Linux distribution or device vendor advisory for backported fixes.
  • Prioritize systems using MediaTek IOMMU support before broader Linux fleet work.
  • Avoid assuming non-MediaTek systems are affected without kernel configuration evidence.

Validation and detection

  • Inventory kernel versions against the CVE affected and fixed version data.
  • Confirm whether the MediaTek IOMMU driver is present and enabled.
  • Review vendor kernel changelogs for the listed stable commit IDs.
  • Check boot or driver logs for MediaTek IOMMU and probe deferral signals.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71071 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux8412e5dd24ffc8bc21a00bfaa0b80d4596cdc9da, 26593928564cf5b576ff05d3cbd958f57c9534bb, 26593928564cf5b576ff05d3cbd958f57c9534bb, 26593928564cf5b576ff05d3cbd958f57c9534bb, 26593928564cf5b576ff05d3cbd958f57c9534bb, 51080de72e26771f0ed9d44982974279ccbc92b8, 6.1.2, 6.0.16unaffected
LinuxLinux6.2, 0, 6.1.160, 6.6.120, 6.12.64, 6.18.3, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.