LiveActive security incident?Get immediate response
CVE Record

CVE-2025-71199: iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver

In the Linux kernel, the following vulnerability has been resolved: iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver at91_adc_interrupt can call at91_adc_touch_data_handler function to start the work by schedule_work(&st->touch_st.workq). If we remove the module which will call at91_adc_remove to make cleanup, it will free indio_dev through iio_device_unregister but quite a bit later. While the work mentioned above will be used. The sequence of operations that may lead to a UAF bug is as follows: CPU0 CPU1 | at91_adc_workq_handler at91_adc_remove | iio_device_unregister(indio_dev) | //free indio_dev a bit later | | iio_push_to_buffers(indio_dev) | //use indio_dev Fix it by ensuring that the work is canceled before proceeding with the cleanup in at91_adc_remove.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel flaw is a cleanup race in the at91-sama5d2 ADC driver. If pending touch/ADC work continues while the device is being removed, kernel memory may be used after it is freed. Business urgency depends on whether affected embedded Linux systems load this driver.

Executive priority

Moderate for organizations operating affected embedded Linux devices; low for environments without this driver. Because severity data is absent, prioritize asset identification first, then patch affected device fleets through normal kernel maintenance.

Technical view

at91_adc_interrupt can schedule st->touch_st.workq, while at91_adc_remove unregisters and later frees indio_dev. The queued work handler may then call iio_push_to_buffers(indio_dev), creating a potential use-after-free. The stated fix cancels the work before cleanup proceeds.

Likely exposure

Exposure appears limited to Linux systems using the at91-sama5d2 ADC Industrial I/O driver. The bundle lists Linux as affected but provides no CPEs and unclear version-range semantics. General servers without this driver are unlikely to be exposed based on the provided evidence.

Exploitation context

The source bundle does not report active exploitation, and KEV is false. The described trigger involves module or device removal racing with scheduled driver work. No public exploit details are included in the supplied sources.

Researcher notes

The evidence supports a kernel driver UAF caused by missing work cancellation during remove. Impact, privileges required, and exploitability are not quantified in the bundle. The affected version list is not sufficient for precise fleet triage without vendor kernel mapping.

Mitigation direction

  • Apply Linux stable kernel updates containing the referenced at91-sama5d2_adc fix.
  • Use vendor kernel advisories for exact affected and fixed package versions.
  • Prioritize embedded systems that load the at91-sama5d2 ADC driver.
  • Until patched, treat driver removal/unload workflows as higher risk.

Validation and detection

  • Inventory kernels and confirm whether at91-sama5d2_adc support is present or loaded.
  • Map deployed kernel versions to vendor fixed releases or referenced stable commits.
  • Review embedded device builds for the IIO ADC/touch driver configuration.
  • Confirm change management covers devices where kernel updates require firmware images.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2025-71199 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux23ec2774f1cc168b1f32a2e0ed2709cb473bb94e, 23ec2774f1cc168b1f32a2e0ed2709cb473bb94e, 23ec2774f1cc168b1f32a2e0ed2709cb473bb94e, 23ec2774f1cc168b1f32a2e0ed2709cb473bb94e, 23ec2774f1cc168b1f32a2e0ed2709cb473bb94e, 23ec2774f1cc168b1f32a2e0ed2709cb473bb94e, 23ec2774f1cc168b1f32a2e0ed2709cb473bb94eunaffected
LinuxLinux4.19, 0, 5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, 6.18.8, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.