Security readout for executives and security teams
Plain-English summary
CVE-2025-71191 is a Linux kernel resource-leak bug in the at_hdmac DMA driver. The kernel may keep an extra device reference after successful DMA channel allocation. The public record does not provide a CVSS score or exploitation evidence. Business impact is most likely stability or availability risk on systems that use this driver.
Executive priority
Handle through normal kernel and vendor patch management, with higher priority for embedded or industrial systems where downtime is costly. There is no public evidence here of active exploitation, but the bug can affect kernel resource management and long-running system reliability.
Technical view
The fix ensures a device reference acquired during of_dma_xlate() is released when channel resources are freed. A prior change fixed some error paths, but successful allocation still leaked the reference. Affected entries list Linux kernel versions including 3.10 through 6.19, with stable kernel commits referenced as fixes.
Likely exposure
Exposure appears limited to Linux systems running affected kernels where the at_hdmac DMA engine driver and relevant device-tree DMA translation path are used. This is more relevant to embedded, appliance, and industrial Linux deployments than general-purpose servers without this hardware path.
Exploitation context
The source bundle shows no CISA KEV listing and no cited evidence of active exploitation. The described flaw is a kernel reference leak, not a direct remote code execution issue. Practical impact likely depends on whether repeated channel allocation can trigger resource exhaustion or device lifecycle problems.
Researcher notes
Evidence is limited to the CVE description, Linux stable commits, and Siemens advisory links. No CVSS, CWE, exploitability assessment, or product-specific Siemens affected details are included in the provided bundle. Avoid assuming broad exposure without confirming at_hdmac use and vendor backport status.
Mitigation direction
- Check vendor kernel advisories for fixed builds containing the referenced stable commits.
- Update affected Linux kernels through your distribution, device vendor, or kernel maintenance channel.
- For Siemens-managed environments, review the two Siemens ProductCERT advisories linked in the record.
- Prioritize embedded and industrial assets using at_hdmac-capable hardware.
- If no update is available, ask the vendor for supported mitigation guidance.
Validation and detection
- Inventory Linux kernel versions across affected appliances and embedded systems.
- Check whether the at_hdmac driver is built, loaded, or enabled in kernel configuration.
- Confirm whether relevant device-tree DMA mappings use this driver path.
- Verify installed kernels include one of the referenced stable fix commits or vendor backports.
- Track vendor advisories for product-specific affected status and update availability.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2025-71191 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/49d964cde422dc66fea514b7ab24aa729df7081dCVE reference, Linux
- https://git.kernel.org/stable/c/4c67b4f45c8540ee4e62e24ca4608c6a9a81ee0fCVE reference, Linux
- https://git.kernel.org/stable/c/48b2d7f530b83cb149dbf0e48f95ccadb2d90da9CVE reference, Linux
- https://git.kernel.org/stable/c/987c71671367f42460689b78244d7b894c50999aCVE reference, Linux
- https://git.kernel.org/stable/c/6a86cf2c09e149d5718a5b7090545f7566da9334CVE reference, Linux
- https://git.kernel.org/stable/c/f3c23b7e941349505c3d40de2cc0acd93d9ac057CVE reference, Linux
- https://git.kernel.org/stable/c/b9074b2d7a230b6e28caa23165e9d8bc0677d333CVE reference, Linux
- https://cert-portal.siemens.com/productcert/html/ssa-253495.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.