Executive brief
A security vulnerability has been identified in the Linux kernel's Airoha network driver. The flaw involves a memory management error where the system attempts to access data after it has already been released. If exploited, this could allow a local user to cause a system crash or potentially gain unauthorized access to sensitive information, impacting the overall stability and security of the affected device.
Technical details
A use-after-free (UAF) vulnerability exists in the airoha_npu_get() function within drivers/net/ethernet/airoha/airoha_npu.c. The root cause is the premature calling of of_node_put(np) before accessing np->name in an error path. Specifically, if of_find_device_by_node(np) fails to find a device (returning NULL), the subsequent error logging attempt accesses the already-released node pointer. This local vulnerability requires low privileges and no user interaction. The issue has been resolved in stable kernel updates by reordering the release of the device node to occur after all potential references to it are completed.
Affected products
- Linux Linux Kernel 6.15 to 6.15.8, 6.16-rc1 to 6.16-rc6
Timeline
- 2025-08-16: disclosed
- 2025-07-16: patched
- 2025-08-16: advisory