CVE-2025-71199

Root

Cause

The vulnerability lies in the at91-sama5d2_adc driver within the Linux kernel. The interrupt handler at91_adc_interrupt can schedule a work item (st->touch_st.workq) via at91_adc_touch_data_handler. If the module is removed while this work is pending or executing, the cleanup code iio_device_unregister frees the indio_dev structure, but the work may still run and attempt to access the freed memory, leading to a use-after-free (UAF) condition.

Exploitation

Scenario

An attacker would need to trigger the ADC touch interrupt to schedule the work, then race that with a concurrent module removal operation. The attack requires local access to the system and the ability to unload the driver module, or rely on a system administrator performing a module removal while the work is queued. No special privileges beyond normal user access to trigger the interrupt are needed for the initial condition.

Impact

If successfully exploited, the UAF can allow an attacker to cause a kernel memory corruption, leading to a system crash (denial of service) or potentially arbitrary code execution in kernel context, depending on the memory allocator state.

Mitigation

The fix involves ensuring the work is cancelled (using cancel_work_sync) before proceeding with cleanup in at91_adc_remove. This prevents the race condition. The patch has been applied to multiple stable kernel versions as referenced in the commit history. Users should update to a kernel version containing the fix [1][2][3][4].