LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71145: usb: phy: isp1301: fix non-OF device reference imbalance

In the Linux kernel, the following vulnerability has been resolved: usb: phy: isp1301: fix non-OF device reference imbalance A recent change fixing a device reference leak in a UDC driver introduced a potential use-after-free in the non-OF case as the isp1301_get_client() helper only increases the reference count for the returned I2C device in the OF case. Increment the reference count also for non-OF so that the caller can decrement it unconditionally. Note that this is inherently racy just as using the returned I2C device is since nothing is preventing the PHY driver from being unbound while in use.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux USB PHY driver reference-counting error can leave software using an I2C device after it has been freed. A successful local attack could compromise confidentiality, integrity, or availability, but exposure appears limited to systems using the ISP1301 driver through the non-Device-Tree path.

Executive priority

Treat as a focused high-priority kernel update, not an organization-wide emergency. Promptly assess embedded, legacy, or specialized hardware using ISP1301; lower priority for systems where the driver or non-OF path is absent. No active exploitation is established.

Technical view

The non-OF path in isp1301_get_client() returned an I2C device without acquiring the reference later released by its caller, creating a potential use-after-free. The fix increments the reference for non-OF devices. The underlying interaction remains inherently racy because the PHY driver can be unbound while the device is in use.

Likely exposure

Exposure requires a Linux system using the ISP1301 USB PHY driver through its non-OF configuration path. The supplied records do not provide complete vulnerable release ranges, and the listed commit identifiers cannot alone establish whether a deployed kernel is affected.

Exploitation context

CVSS 3.1 is 7.8 and describes local, low-privileged exploitation without user interaction. The supplied bundle marks KEV false and provides no evidence of active exploitation or a public exploit. Practical exploitability is not established by these sources.

Researcher notes

This is a reference imbalance introduced while correcting another leak. The relevant condition is the non-OF branch, where the returned I2C device lacked a matching acquired reference. Exact vulnerable ancestry, release boundaries, trigger conditions, and reliable security impact require source-tree and vendor analysis beyond the supplied evidence.

Mitigation direction

  • Update to a vendor-supported kernel containing the applicable stable ISP1301 reference-counting fix.
  • Check distribution or appliance vendor advisories for exact affected and fixed release mappings.
  • Prioritize systems that load ISP1301 and use non-OF device configuration.
  • Where operationally acceptable, prevent use of the affected driver until the kernel is updated.

Validation and detection

  • Inventory kernel versions and determine whether the ISP1301 USB PHY driver is present or loaded.
  • Confirm whether ISP1301 devices are configured through the non-OF path.
  • Map the deployed kernel source to the vendor's fixed commit or release.
  • After updating, verify the running kernel includes the applicable stable fix.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71145 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
7Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2025-71145Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux0c2b0e747010fa645342138d71339a0ecb823bb0, 33c2e2a87313bc1afe9f7febbbb2014c431a2c5d, 8481323710062051b3c42bff94ee5b18a2b496ca, 8bd518ea03b81eb7b4a734b7b901866c448f6c07, cefaad839a384a72331aedad927b1944fb6943dc, c84117912bddd9e5d87e68daf182410c98181407, 21c7c83d592e6335bfb6d65608da3726f976bad4, 5.10.248unaffected
LinuxLinuxSee advisoryunaffected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.