Vulnerability in Linux

CVE-2025-71145

In the Linux kernel, the following vulnerability has been resolved: usb: phy: isp1301: fix non-OF device reference imbalance A recent change fixing a device reference leak in a UDC driver introduced a potential use-after-free in the non-OF case as the isp1301_get_client() helper only increases the reference count for the returned I2C device in the OF case. Increment the reference count also for non-OF so that the caller can decrement it unconditionally. Note that this is inherently racy just as using the returned I2C device is since nothing is preventing the PHY driver from being unbound while in use.

Published · last modified .

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.002 (6.0th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 6th percentile — 6.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2025-71145: held from 0.002 to 0.002.

EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: +0.000

Affected products

  • Linux — versions 33c2e2a87313bc1afe9f7febbbb2014c431a2c5d, c84117912bddd9e5d87e68daf182410c98181407, 8bd518ea03b81eb7b4a734b7b901866c448f6c07
  • Linux Kernel

References

Frequently asked questions

What is CVE-2025-71145?
CVE-2025-71145 is a high-severity vulnerability in Linux. CVSS score: 7.8/10. Published 2026-01-23.
How severe is CVE-2025-71145?
High severity. CVSS v3 base score is 7.8 out of 10.