CVE-2025-71190

What it actually does

The bcm-sba-raid DMA engine driver in the Linux kernel fails to release a mailbox device reference obtained during probe, causing a reference leak on probe error paths and module unbind that can exhaust device resources or trigger crashes.

Why it matters to the business

Systems running affected Linux kernels may experience gradual resource exhaustion or unexpected crashes when the bcm-sba-raid driver is loaded or unloaded, potentially disrupting storage or DMA-dependent workloads and requiring reboots.

How an attack unfolds

An attacker with local access loads or unloads the bcm-sba-raid driver repeatedly, or triggers probe failures, to leak mailbox device references until kernel resources are exhausted and the system becomes unstable or crashes.

How to fix it

Update the Linux kernel to the fixed commit 4316e4c4fd2c09f68a262365f21847cafa8fe9dd or later; rebuild and reboot with the patched kernel. For dotnet-bootstrap-8 (MinimOS) update to version 8.0.122-r0 or newer.

How to confirm the fix worked

Verify the running kernel contains commit 4316e4c4fd2c09f68a262365f21847cafa8fe9dd, confirm the driver unbind path releases the mailbox reference via code review or dynamic tracing, and test probe failure scenarios do not leak references.

Typical attack path

1. Obtain local access to a system with the vulnerable bcm-sba-raid driver enabled
2. Trigger repeated module load/unload or probe failure conditions
3. Accumulate unreleased mailbox device references until resource limits are hit
4. Cause kernel instability, memory pressure, or denial of service

How to detect it

Review kernel logs for repeated bcm-sba-raid probe or mailbox device reference warnings; monitor for gradual increases in unreleased device references via kernel memory statistics or slabinfo before and after driver operations.

What your security team should do

• Apply the kernel patch containing commit 4316e4c4fd2c09f68a262365f21847cafa8fe9dd immediately on all affected systems
• Prioritize reboot of production systems using bcm-sba-raid hardware
• Monitor for resource exhaustion symptoms on systems running the vulnerable driver
• Disable the bcm-sba-raid driver if the hardware is not required until patched