LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71162: dmaengine: tegra-adma: Fix use-after-free

In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra-adma: Fix use-after-free A use-after-free bug exists in the Tegra ADMA driver when audio streams are terminated, particularly during XRUN conditions. The issue occurs when the DMA buffer is freed by tegra_adma_terminate_all() before the vchan completion tasklet finishes accessing it. The race condition follows this sequence: 1. DMA transfer completes, triggering an interrupt that schedules the completion tasklet (tasklet has not executed yet) 2. Audio playback stops, calling tegra_adma_terminate_all() which frees the DMA buffer memory via kfree() 3. The scheduled tasklet finally executes, calling vchan_complete() which attempts to access the already-freed memory Since tasklets can execute at any time after being scheduled, there is no guarantee that the buffer will remain valid when vchan_complete() runs. Fix this by properly synchronizing the virtual channel completion: - Calling vchan_terminate_vdesc() in tegra_adma_stop() to mark the descriptors as terminated instead of freeing the descriptor. - Add the callback tegra_adma_synchronize() that calls vchan_synchronize() which kills any pending tasklets and frees any terminated descriptors. Crash logs: [ 337.427523] BUG: KASAN: use-after-free in vchan_complete+0x124/0x3b0 [ 337.427544] Read of size 8 at addr ffff000132055428 by task swapper/0/0 [ 337.427562] Call trace: [ 337.427564] dump_backtrace+0x0/0x320 [ 337.427571] show_stack+0x20/0x30 [ 337.427575] dump_stack_lvl+0x68/0x84 [ 337.427584] print_address_description.constprop.0+0x74/0x2b8 [ 337.427590] kasan_report+0x1f4/0x210 [ 337.427598] __asan_load8+0xa0/0xd0 [ 337.427603] vchan_complete+0x124/0x3b0 [ 337.427609] tasklet_action_common.constprop.0+0x190/0x1d0 [ 337.427617] tasklet_action+0x30/0x40 [ 337.427623] __do_softirq+0x1a0/0x5c4 [ 337.427628] irq_exit+0x110/0x140 [ 337.427633] handle_domain_irq+0xa4/0xe0 [ 337.427640] gic_handle_irq+0x64/0x160 [ 337.427644] call_on_irq_stack+0x20/0x4c [ 337.427649] do_interrupt_handler+0x7c/0x90 [ 337.427654] el1_interrupt+0x30/0x80 [ 337.427659] el1h_64_irq_handler+0x18/0x30 [ 337.427663] el1h_64_irq+0x7c/0x80 [ 337.427667] cpuidle_enter_state+0xe4/0x540 [ 337.427674] cpuidle_enter+0x54/0x80 [ 337.427679] do_idle+0x2e0/0x380 [ 337.427685] cpu_startup_entry+0x2c/0x70 [ 337.427690] rest_init+0x114/0x130 [ 337.427695] arch_call_rest_init+0x18/0x24 [ 337.427702] start_kernel+0x380/0x3b4 [ 337.427706] __primary_switched+0xc0/0xc8

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel memory-safety bug in the Tegra ADMA audio DMA driver. During audio stream termination, a delayed completion tasklet can touch memory that was already freed, causing a kernel use-after-free and likely crash. The source bundle does not provide CVSS, remote exploitability, or confirmed exploitation.

Executive priority

Treat this as a targeted platform risk, not a broad enterprise Linux emergency. Prioritize Tegra-based embedded, appliance, and industrial systems, especially where crashes affect availability. Urgency increases if exposed devices run unpatched vendor kernels or support audio workloads.

Technical view

The race is between tegra_adma_terminate_all() freeing a DMA descriptor buffer and a previously scheduled virtual-channel completion tasklet later calling vchan_complete(). The upstream fix changes termination handling to mark descriptors terminated and adds synchronization through vchan_synchronize() so pending tasklets are killed before descriptors are freed.

Likely exposure

Likely exposure is Linux systems using the Tegra ADMA driver, especially NVIDIA Tegra-based devices with audio DMA activity. Generic Linux servers without this hardware or driver are unlikely to be exposed. The bundle lists Linux kernel versions and stable commits, but distribution-specific package status is not provided.

Exploitation context

The provided evidence shows a KASAN-detected use-after-free triggered around audio playback stop and XRUN conditions. KEV is false in the bundle, and no cited source confirms active exploitation. The bundle does not establish whether this is practically exploitable beyond denial of service.

Researcher notes

The key evidence is a race in virtual-channel descriptor lifecycle management. The fix path is synchronization-focused, not input filtering. The source bundle lacks CVSS, CWE, detailed affected product mapping, and exploitability analysis, so conclusions should remain bounded to kernel crash and potential memory-safety impact.

Mitigation direction

  • Identify Linux systems using the Tegra ADMA audio DMA driver.
  • Apply kernel or vendor updates containing the referenced stable fixes.
  • Check device, distribution, and Siemens guidance for product-specific remediation.
  • Prioritize embedded or industrial devices where kernel updates lag.
  • Document any unpatched Tegra systems for risk acceptance or upgrade planning.

Validation and detection

  • Confirm whether the Tegra ADMA driver is present and enabled.
  • Verify the running kernel includes an applicable referenced stable commit.
  • Review crash logs for vchan_complete or tegra_adma use-after-free traces.
  • Map affected kernel versions to vendor package advisories.
  • Confirm Siemens-listed products separately if they are in scope.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71162 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxf46b195799b5cb05338e7c44cb3617eacb56d755, f46b195799b5cb05338e7c44cb3617eacb56d755, f46b195799b5cb05338e7c44cb3617eacb56d755, f46b195799b5cb05338e7c44cb3617eacb56d755, f46b195799b5cb05338e7c44cb3617eacb56d755, f46b195799b5cb05338e7c44cb3617eacb56d755, f46b195799b5cb05338e7c44cb3617eacb56d755unaffected
LinuxLinux4.7, 0, 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.67, 6.18.7, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.