SECUFOCUSNOW
Home›CVE index›CVE-2025-71162
Review reviewHigh

CVE-2025-71162

Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra-adma: Fix use-after-free A use-after-free bug exists in the Tegra ADMA driver when audio streams are terminated, particularly during XRUN conditions. The issue occurs when the DMA buffer is freed by tegra_adma_terminate_all() before the vchan completion tasklet finishes accessing it. The race condition follows this sequence: 1. DMA transfer completes, triggering an interrupt that schedules the completion tasklet (tasklet has not executed yet) 2. Audio playback stops, calling tegra_adma_terminate_all() which...

CVSS
7.8
EPSS
0.19%
8.68% percentile
CISA KEV
Not listed
Published
2026.01.26
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.19%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra-adma: Fix use-after-free A use-after-free bug exists in the Tegra ADMA driver when audio streams are terminated, particularly during XRUN conditions. The issue occurs when the DMA buffer is freed by tegra_adma_terminate_all() before the vchan completion tasklet finishes accessing it. The race condition follows this sequence: 1. DMA transfer completes, triggering an interrupt that schedules the completion tasklet (tasklet has not executed yet) 2. Audio playback stops, calling tegra_adma_terminate_all() which...

Affected product and versions

Product
Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
Affected versions
>= f46b195799b5cb05338e7c44cb3617eacb56d755 < 5f8d1d66a952d0396671e1f21ff8127a4d14fb4e, >= f46b195799b5cb05338e7c44cb3617eacb56d755 < 76992310f80776b4d1f7f8915f59b92883a3e44c, >= f46b195799b5cb05338e7c44cb3617eacb56d755 < ae3eed72de682ddbba507ed2d6b848c21a6b721e, >= f46b195799b5cb05338e7c44cb3617eacb56d755 < 59cb421b0902fbef2b9512ae8ba198a20f26b41f, >= f46b195799b5cb05338e7c44cb3617eacb56d755 < cb2c9c4bb1322cc3c9984ad17db8cdd2663879ca, >= f46b195799b5cb05338e7c44cb3617eacb56d755 < be655c3736b3546f39bc8116ffbf2a3b6cac96c4, >= f46b195799b5cb05338e7c44cb3617eacb56d755 < 2efd07a7c36949e6fa36a69183df24d368bf9e96, >= 4.7, >= V3.1.6, >= 4.7 < 5.10.249, >= 5.11 < 5.15.199, >= 5.16 < 6.1.162, >= 6.2 < 6.6.122, >= 6.7 < 6.12.67, >= 6.13 < 6.18.7, 6.19
Fixed versions
5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.67, 6.18.7

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-416