LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71188: dmaengine: lpc18xx-dmamux: fix device leak on route allocation

In the Linux kernel, the following vulnerability has been resolved: dmaengine: lpc18xx-dmamux: fix device leak on route allocation Make sure to drop the reference taken when looking up the DMA mux platform device during route allocation. Note that holding a reference to a device does not prevent its driver data from going away so there is no point in keeping the reference.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2025-71188 is a Linux kernel issue in the LPC18xx DMA mux driver. The published fix releases a device reference that was not dropped during route allocation. The source bundle does not provide CVSS, CWE, confirmed impact, or exploit details, so business risk should be treated as uncertain and scoped to affected Linux-based systems.

Executive priority

Treat this as a targeted Linux kernel hygiene item, not an emergency, unless critical embedded or industrial assets use the affected driver. Prioritize asset identification and vendor patch tracking because the public record lacks severity and exploitation evidence.

Technical view

The resolved kernel change is in dmaengine lpc18xx-dmamux route allocation. It fixes a device reference leak taken while looking up the DMA mux platform device. Sources state that retaining the reference does not protect driver data, so the reference should be dropped. Multiple Linux stable commits are listed as fixes.

Likely exposure

Likely exposure is limited to Linux kernels or downstream products using the lpc18xx-dmamux DMA mux driver. The CVE record lists Linux as affected and provides kernel version markers, but no CPEs or product-specific affected matrix beyond a Siemens advisory reference.

Exploitation context

No source in the bundle reports active exploitation, and the CVE is not marked KEV. The provided materials do not describe attacker access, exploit primitives, or reliable security impact beyond the fixed device leak.

Researcher notes

The main evidence is the kernel fix description and stable commit references. The record lacks CVSS, CWE, CPEs, exploitability analysis, and concrete impact. Avoid broad Linux exposure claims without confirming driver presence and downstream backport status.

Mitigation direction

  • Inventory Linux kernels in embedded, industrial, and appliance environments.
  • Check whether the lpc18xx-dmamux driver is present or enabled.
  • Apply vendor-supported kernel updates that include the listed stable fixes.
  • For Siemens-managed products, review SSA-253495 and follow its product guidance.
  • Monitor CVE and vendor advisories for severity, impact, and fixed-release updates.

Validation and detection

  • Map deployed kernel versions against vendor advisories and fixed releases.
  • Confirm downstream kernels include one of the referenced stable fix commits or backports.
  • Review firmware manifests or SBOMs for lpc18xx-dmamux driver use.
  • Document systems where the driver is absent as lower priority.
  • Recheck CVE status if CVSS, CPEs, or exploitation evidence is added.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71188 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
1ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

siemens-SADPADP container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe5f4ae84be7421010780984bdc121eac15997327, e5f4ae84be7421010780984bdc121eac15997327, e5f4ae84be7421010780984bdc121eac15997327, e5f4ae84be7421010780984bdc121eac15997327, e5f4ae84be7421010780984bdc121eac15997327, e5f4ae84be7421010780984bdc121eac15997327, e5f4ae84be7421010780984bdc121eac15997327unaffected
LinuxLinux4.3, 0, 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.67, 6.18.7, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.