Improper resource shutdown or release in Linux kernel - CVE-2025-71299

Vulnerability details

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to improper resource shutdown in cadence-quadspi probe error handling when parsing broken or missing device tree flash descriptions. A local attacker can trigger device initialization with a malformed device tree configuration to cause a denial of service.

The issue is particularly exposed during probe error paths for flashes attached to the controller.

Affected software

How to mitigate CVE-2025-71299

External References

• https://git.kernel.org/stable/c/08dca4c8099a41a9fa3be128a793387603f73a17
• https://git.kernel.org/stable/c/9f0736a4e136a6eb61e0cf530ddc18ab6d816ba3
• https://git.kernel.org/stable/c/dcaa104ad9c860a6dbd5797919e0ec0b1cd5a57a

Related Security Bulletins

• Improper resource shutdown or release in Linux kernel spi driver