CVE-2025-71272
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: most: core: fix resource leak in most_register_interface error paths The function most_register_interface() did not correctly release resources if it failed early (before registering the device). In these cases, it returned an error code immediately, leaking the memory allocated for the interface. Fix this by initializing the device early via device_initialize() and calling put_device() on all error paths. The most_register_interface() is expected to call put_device() on error which frees the resources allocated in the caller. The put_device() either calls release_mdev() or dim2_release(), depending on the caller. Switch to using device_add() instead of device_register() to handle the split initialization.
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-05-06 12:16:27.213000
Last modified
2026-10-21 13:18:25.973000
View original CVE JSON
{
"id": "CVE-2025-71272",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-05-06T12:16:27.213",
"lastModified": "2026-10-21T13:18:25.973",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmost: core: fix resource leak in most_register_interface error paths\n\nThe function most_register_interface() did not correctly release resources\nif it failed early (before registering the device). In these cases, it\nreturned an error code immediately, leaking the memory allocated for the\ninterface.\n\nFix this by initializing the device early via device_initialize() and\ncalling put_device() on all error paths.\n\nThe most_register_interface() is expected to call put_device() on\nerror which frees the resources allocated in the caller. The\nput_device() either calls release_mdev() or dim2_release(),\ndepending on the caller.\n\nSwitch to using device_add() instead of device_register() to handle\nthe split initialization."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nmost: core: corregir fuga de recursos en las rutas de error de most_register_interface\n\nLa función most_register_interface() no liberaba correctamente los recursos si fallaba prematuramente (antes de registrar el dispositivo). En estos casos, devolvía un código de error inmediatamente, fugando la memoria asignada para la interfaz.\n\nSolucionar esto mediante la inicialización temprana del dispositivo a través de device_initialize() y llamando a put_device() en todas las rutas de error.\n\nSe espera que most_register_interface() llame a put_device() en caso de error, lo que libera los recursos asignados en el llamador. put_device() llama a release_mdev() o a dim2_release(), dependiendo del llamador.\n\nCambiar a usar device_add() en lugar de device_register() para manejar la inicialización dividida."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/most/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "723de0f9171eeb49a3ae98cae82ebbbb992b3a7c",
"lessThan": "82f42a13e3d7a07a950ee4fa2d4c74843a3e7ace",
"versionType": "git",
"status": "affected"
},
{
"version": "723de0f9171eeb49a3ae98cae82ebbbb992b3a7c",
"lessThan": "a49028a796d7b94f8e3ab9bd34b18f36be235459",
"versionType": "git",
"status": "affected"
},
{
"version": "723de0f9171eeb49a3ae98cae82ebbbb992b3a7c",
"lessThan": "af0b99b2214a10554adb5b868240d23af6e64e71",
"versionType": "git",
"status": "affected"
},
{
"version": "723de0f9171eeb49a3ae98cae82ebbbb992b3a7c",
"lessThan": "2f483f3817fb0e4209ac5de928778b1da0cc8574",
"versionType": "git",
"status": "affected"
},
{
"version": "723de0f9171eeb49a3ae98cae82ebbbb992b3a7c",
"lessThan": "1f4c9d8a1021281750c6cda126d6f8a40cc24e71",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/most/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.6",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.6",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.160",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.75",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.16",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.19.6",
"lessThanOrEqual": "6.19.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.0",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-401"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.6",
"versionEndExcluding": "6.12.75",
"matchCriteriaId": "168F1117-B247-4CC5-B097-132EE9E96FDD"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.18.16",
"matchCriteriaId": "B4B8CDA9-BADF-4CF5-8B3B-702DE8EEA40B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19",
"versionEndExcluding": "6.19.6",
"matchCriteriaId": "373EEEDA-FAA1-4FB4-B6ED-DB4DD99DBE67"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/1f4c9d8a1021281750c6cda126d6f8a40cc24e71",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/2f483f3817fb0e4209ac5de928778b1da0cc8574",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/82f42a13e3d7a07a950ee4fa2d4c74843a3e7ace",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a49028a796d7b94f8e3ab9bd34b18f36be235459",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/af0b99b2214a10554adb5b868240d23af6e64e71",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}