Junglewise Threat Intelligence

CVE-2025-71272: Linux Kernel MOST core resource leak in most_register_interface

CVE-2025-71272 · Severity: medium · CVSS 5.5 · Published 2026-05-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's MOST (Media Oriented Systems Transport) driver could allow a local user to cause a resource leak. This occurs when the system fails to properly clean up memory during certain error conditions when registering hardware interfaces. Over time, this could lead to system instability or a denial-of-service condition as available memory is exhausted.

Technical details

A memory leak vulnerability exists in the Linux kernel's MOST (Media Oriented Systems Transport) subsystem within 'drivers/most/core.c'. The function 'most_register_interface()' failed to release allocated memory and device IDs if an error occurred early in the registration process, specifically before 'device_register()' was called. An attacker with local access could potentially trigger these error paths to exhaust system memory (CWE-401). The fix involves refactoring the initialization to use 'device_initialize()' early and ensuring 'put_device()' is called on all error paths to trigger the appropriate release callbacks ('release_mdev' or 'dim2_release'). The registration logic was also updated to use 'device_add()' instead of 'device_register()' to support this split initialization.

Affected products

  • Linux Linux Kernel 5.6 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6

Timeline

  • 2025-11-27: other: Patch authored
  • 2026-05-06: disclosed: CVE published
  • 2026-05-12: advisory: NVD enrichment and analysis completed

References

Related threats