CVE-2025-71186

What it actually does

The vulnerability is a reference leak on a DMA mux platform device during route allocation in the STM32 DMAMUX driver, where a taken reference is not released after lookup.

Why it matters to the business

On affected embedded Linux systems using STM32 DMA hardware, repeated route allocations can lead to gradual resource exhaustion and potential instability or denial of service.

How an attack unfolds

An attacker with local privileges repeatedly triggers DMA route allocations through the affected driver path, causing unreleased device references to accumulate until system resources are depleted.

How to fix it

Upgrade affected packages to fixed versions: linux-virt (MinimOS) 6.12.41-r0, linux-virt-doc (MinimOS) 6.12.41-r0, or kernel GIT commit 3b42020e6790a5e19b36c187ed5b488a5716f97f.

How to confirm the fix worked

Confirm the running kernel version matches or exceeds the fixed releases and inspect the stm32 dmamux code for the reference drop after platform device lookup.

Typical attack path

1. Obtain local user access on an affected Linux system
2. Invoke DMA route allocation operations via user-space interfaces or drivers
3. Repeat allocations to trigger reference leaks and exhaust resources

How to detect it

Review kernel logs for DMA mux allocation warnings and use kernel debugging to track unreleased platform device references during route operations.

What your security team should do

• Apply kernel updates to fixed versions immediately on STM32-based systems
• Review and restrict local access to DMA interfaces where possible
• Monitor kernel resource usage on affected devices for signs of leaks