Security readout for executives and security teams
Plain-English summary
A Linux GPIO driver can crash the system if its device is unplugged while an interrupt worker is running. Exposure appears limited to systems using the MPSSE GPIO driver with relevant hardware. The supplied sources do not establish remote exploitation or attacks in the wild.
Executive priority
Treat as a high-priority targeted update for exposed operational, embedded, or hardware-control systems. Broad emergency action is not supported because the trigger is local and hardware-dependent, with no evidence of active exploitation. Confirm exposure before prioritizing fleet-wide disruption.
Technical view
The gpio-mpsse disconnect path failed to stop active IRQ workers. Disconnecting hardware could therefore leave worker activity referencing invalid state and trigger a kernel crash. The fix protects the worker list with a spinlock and tears down workers during disconnect. The supplied description demonstrates availability impact; it does not explain the CVSS-rated confidentiality or integrity impacts.
Likely exposure
Most Linux systems are unlikely to exercise this driver and hardware path. Prioritize systems using gpio-mpsse with relevant Sealevel or compatible hardware, particularly where devices can be disconnected during IRQ activity. The bundle lists affected kernel versions but does not provide sufficiently clear distribution-specific package ranges.
Exploitation context
The CVSS vector requires local access, low privileges, low complexity, and no user interaction. Triggering also depends on an active IRQ worker and device disconnection. This CVE is not in KEV, and the supplied sources provide no evidence of active exploitation or public weaponization.
Researcher notes
No CWE is supplied. The record references two stable-kernel commits, likely for different maintained branches, but the bundle does not map them clearly to fixed distribution releases. Analysts should distinguish the documented disconnect-time crash from broader confidentiality and integrity effects implied only by the CVSS vector.
Mitigation direction
- Install a vendor-supported kernel containing the applicable referenced stable fix.
- Check distribution or appliance guidance for exact fixed package versions.
- Until updated, prevent disconnection of affected hardware while IRQ activity may be running.
- Restrict physical and local access to systems using the affected driver.
Validation and detection
- Inventory kernel versions on systems connected to relevant GPIO hardware.
- Determine whether gpio-mpsse is present and actively used.
- Confirm the installed vendor kernel includes the applicable referenced fix.
- Review kernel crash logs for failures associated with gpio-mpsse device disconnection.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-71158 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/472d900c8bcac301ae0e40fdca7db799bd989ff5CVE reference, Linux
- https://git.kernel.org/stable/c/179ef1127d7a4f09f0e741fa9f30b8a8e7886271CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.