CVE-2025-71191

What it actually does

Reference count leak on successful DMA channel allocation via of_dma_xlate() prevents the platform device from being released when channel resources are freed, causing a permanent device reference leak.

Why it matters to the business

Long-running systems performing repeated DMA channel setup and teardown can exhaust device reference counts or related kernel resources, leading to gradual denial of service or reduced availability on affected hardware.

How an attack unfolds

A local attacker with the ability to trigger DMA channel allocation and release paths (for example through userspace DMA APIs or drivers using the at_hdmac controller) repeatedly exercises the leaky success path, accumulating unreleased device references until resource limits are hit.

How to fix it

Upgrade the Linux kernel to a revision containing commit 49d964cde422dc66fea514b7ab24aa729df7081d or later; for affected MinimOS packages upgrade istio-1.27 and related components to version 1.27.3-r1 or newer that incorporate the corrected kernel.

How to confirm the fix worked

Confirm the running kernel contains commit 49d964cde422dc66fea514b7ab24aa729df7081d; verify installed package versions match the listed fixed releases; inspect kernel logs and device reference counts under load that exercises DMA channel allocation.

Typical attack path

1. Obtain local code execution or access on a system using the at_hdmac DMA controller.
2. Trigger repeated allocation and release of DMA channels through of_dma_xlate paths.
3. Accumulate leaked device references over time.
4. Cause resource exhaustion that impacts DMA functionality or system stability.

How to detect it

Review kernel logs for repeated DMA channel allocation patterns; monitor device reference counts or slab allocator growth associated with platform devices; correlate with processes performing frequent DMA setup calls on systems using the affected controller.

What your security team should do

• Prioritize kernel and package upgrades on any systems exposing the at_hdmac driver.
• Apply updates within standard change windows given the local-only attack vector and moderate CVSS.
• Monitor EPSS trend and kernel mailing list for any future public exploitation details.
• Harden local access controls to reduce the likelihood of triggering the leak path.