LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71154: net: usb: rtl8150: fix memory leak on usb_submit_urb() failure

In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix memory leak on usb_submit_urb() failure In async_set_registers(), when usb_submit_urb() fails, the allocated async_req structure and URB are not freed, causing a memory leak. The completion callback async_set_reg_cb() is responsible for freeing these allocations, but it is only called after the URB is successfully submitted and completes (successfully or with error). If submission fails, the callback never runs and the memory is leaked. Fix this by freeing both the URB and the request structure in the error path when usb_submit_urb() fails.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This CVE is a Linux kernel memory leak in the rtl8150 USB Ethernet driver. If an internal USB request submission fails, allocated memory is not released. The sources do not provide CVSS severity, active exploitation evidence, or a business-impact rating.

Executive priority

Treat this as routine kernel maintenance unless your environment depends on rtl8150 USB Ethernet devices. There is no source-backed evidence of active exploitation, but unpatched kernel memory leaks can affect stability over time.

Technical view

In async_set_registers(), failure of usb_submit_urb() bypasses async_set_reg_cb(), leaving both the async_req structure and URB allocated. The kernel stable fixes add cleanup on the submission-failure path. The issue is tied to the net/usb/rtl8150 driver.

Likely exposure

Exposure appears limited to Linux systems using or shipping the rtl8150 USB Ethernet driver in affected kernel versions. The bundle lists Linux as affected but does not provide CPEs, distributions, or deployment-specific exposure data.

Exploitation context

The source bundle marks CISA KEV as false and provides no cited evidence of active exploitation. It describes a memory leak on an error path, not a confirmed privilege escalation or remote code execution path.

Researcher notes

The evidence is narrow but clear: a failed URB submission leaks allocations because the completion callback never runs. Missing data includes CVSS, CWE, precise distro package status, and any exploitability analysis beyond the kernel commit description.

Mitigation direction

  • Apply the relevant Linux stable kernel fix from vendor-supported packages.
  • Check distribution advisories for backported fixes matching your kernel branch.
  • Prioritize systems using Realtek rtl8150 USB Ethernet hardware or enabled driver modules.
  • Avoid unsupported kernel builds where stable fixes cannot be tracked.

Validation and detection

  • Inventory kernels and determine whether rtl8150 support is present or loaded.
  • Compare running kernel versions against vendor advisories and stable commit references.
  • Confirm patched builds include the usb_submit_urb() failure-path cleanup.
  • Monitor kernel logs for rtl8150-related USB or network driver errors.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71154 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux4d12997a9bb3d217ad4b925ec3074ec89364bf95, 4d12997a9bb3d217ad4b925ec3074ec89364bf95, 4d12997a9bb3d217ad4b925ec3074ec89364bf95, 4d12997a9bb3d217ad4b925ec3074ec89364bf95, 4d12997a9bb3d217ad4b925ec3074ec89364bf95, 4d12997a9bb3d217ad4b925ec3074ec89364bf95, 4d12997a9bb3d217ad4b925ec3074ec89364bf95unaffected
LinuxLinux3.10, 0, 5.10.248, 5.15.198, 6.1.160, 6.6.120, 6.12.64, 6.18.4, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.